> For the complete documentation index, see [llms.txt](https://docs.facephi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.facephi.com/docs.facephi-en/products/facephi-intelligence-platform/modulos/behaviour.md).

# Behaviour

Behaviour allows you to analyze the activity recorded during sessions to identify signals related to the device, the network, the location, and the user's behavior.

The information and available features depend on the services contracted by your organization.

### What you can do

From Behaviour, you can:

* View the sessions recorded in FIP.
* Identify devices, networks, or behaviors that may require attention.
* Analyze the Signals detected during a session.
* View information about devices, connections, and locations.
* Review the recorded events chronologically.
* Access the related identity to further the investigation.
* Analyze alerts and risk levels when Behavioral Detection System is available.

{% hint style="info" %}
An isolated signal does not confirm that fraud exists. Interpret it together with the rest of the available information about the session and the identity.
{% endhint %}

### Available systems

Behaviour can include one or both systems, depending on the services contracted by your organization.

<figure><img src="https://865101184-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUo71Qbj6jZQDavjc0U5X%2Fuploads%2F2MKS8xeZZm0Dy1L6qLIC%2FCaptura%20de%20pantalla%202026-07-30%20a%20las%2010.22.18.png?alt=media&amp;token=48cb5fe2-74a0-4a56-996a-3f93ae7d154e" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
You may only have access to one of these systems. Their availability depends on the contracted services and the permissions associated with your user.
{% endhint %}

### Main concepts

#### Session

A session groups the activity recorded during a user interaction with the service.

It may contain one or more operations, as well as the signals, alerts, rules, and events detected during its course.

#### Signal

A Signal is data detected during the session that provides context about the device, the network, the location, or the user's behavior.

Its detection does not necessarily mean that fraud exists. It should be analyzed together with the rest of the available information.

#### Alert

An alert indicates that a condition has been detected that may require attention or a more detailed review.

Alerts are available when the configuration and contracted services allow the session risk to be assessed.

#### Risk level

The risk level or score helps prioritize the sessions that may need review.

It should not be used on its own to make a decision. Always review the associated signals, alerts, and evidence.

***

### How it relates to other modules

Behaviour connects the activity recorded during a session with other elements of FIP.

From the details of a session, you can access the related identity, view other interactions associated with the same user, and review linked operations when available.

This connection makes it possible to expand the investigation without losing the session context.

***

### Start here

Select the documentation corresponding to the system available for your organization:

* [**Device Intelligence System**](/docs.facephi-en/products/facephi-intelligence-platform/modulos/behaviour/device-intelligence-system.md), to analyze devices, networks, and technical context.
* [**Behavioral Detection System**](/docs.facephi-en/products/facephi-intelligence-platform/modulos/behaviour/behavioral-detection-system.md), to analyze behavior, alerts, and advanced risk.