---
title: "Real Time Threat Analysis"
description: "Watch detections from a protected app as they arrive, over a rolling 60-minute window."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).

**Real Time Threat Analytics** shows detections from a protected app as they arrive, over a rolling window described in the console as *Real Time Hacking Detection for last 60 mins*. Use it while reproducing an attack, or when you need to see whether something is happening right now rather than what happened last month.

Open **Mobile App Security → Analytics → Real Time Threat Analytics**.

## Filters

| Filter | Description |
| :----- | :---------- |
| **Operating System** | `Android` or `iOS`. |
| **Application** | The app to watch. Type to search by name or package name. |
| **Refresh Rate** | How often the page pulls new data: `1 min`, `5 min`, or `10 min`. |

**Note:** 
There is no Sealing Mode or Period filter here — the window is always the last 60 minutes. Real-time streaming is a Release-mode feature, so a Test-mode build may show nothing.


## Widgets

### Summary

A header card naming the selected app and package, with two counters for the window:

- **Hacking Attempts**
- **Unique Devices Hacking Attempts**

### Popular Insights

The single most frequent value in each dimension during the window, giving you the shape of what is happening at a glance:

| Insight | Meaning |
| :------ | :------ |
| **Hacking Type** | The threat category seen most often. |
| **Location** | The country producing the most detections. |
| **Device** | The device model producing the most detections. |
| **Emulator** | Whether emulator environments are involved. |
| **Rooting Enabled** | Count of detections from rooted devices. |

### Hacking Types Streaming

Detections plotted against time across the window, so you can see bursts as they happen.

### Protected Unique Devices Data

Distinct devices reporting over the same window, plotted on the same time axis. Compare it with the chart above: a rising attempt count on a flat device count means a small number of devices generating a lot of traffic.

### Hacking Attempts By Map Overlay

A world map of the window's detections, with a table beneath it:

| Column | Meaning |
| :----- | :------ |
| **Country** | Country the detections came from. |
| **Hacking Attempts** | Detections from that country. |
| **Unique Devices Hacking Attempts** | Distinct devices behind them. |

### List of Hacking Attempts

The individual detections in the window. **FILTER** narrows the list and **EXPORT** downloads it.

Device columns sit under a **Device Details** header and detection columns under **Hacking Details**. The columns depend on the selected operating system:

| Column | Platform | Meaning |
| :----- | :------- | :------ |
| **Action** | Both | Icons that open more detail for the row. See below. |
| **Reported On** | Both | When the detection was reported. |
| **AppSealing Version** | Android | Sealing version the app was built with. |
| **SDK Version** | iOS | AppSealing SDK version the app was built with. |
| **Android Id** | Android | The device's SSAID. |
| **Model Name** | Both | Device model. |
| **Android Version** / **iOS Version** | Both | OS version. |
| **App Version** | Android | Version of your app. |
| **Country** | Both | Where the detection came from. |
| **Attempts** | Both | Number of attempts in the entry. |
| **Emulator** | Android | Whether an emulator was detected. |
| **Rooting** | Android | Whether the device is rooted (**Rooted** or **Not Rooted**). |
| **Jailbreak** | iOS | Whether the device is jailbroken (**Yes** or **No**). |
| **Hacking Type** | Both | The threat category. |

**Note:** 
`Android Id` is the SSAID reported by the device. It identifies a device across sessions, which is what makes repeat offenders visible — treat it as personal data and handle it accordingly.


The **Action** column holds this icon:

- **Magnifier** — loads a second table, **Hacking Attempts By Device Information**, below the list (described next).

**Note:** 
The magnifier's device information is available only with the Professional or Enterprise plan. To use it, contact the [Help Center](https://support.doverunner.com).


### Hacking Attempts By Device Information

Appears after you click the magnifier on a row in **List of Hacking Attempts**. It lists detections from the three days up to the selected entry that match its device model, country, and AppSealing or SDK version, so you can see what else that kind of device has been doing. **FILTER** and **EXPORT** work as above.

| Column | Platform | Meaning |
| :----- | :------- | :------ |
| **Reported On** | Both | When the detection was reported. |
| **Android Id** | Android | The device's SSAID. |
| **UUID** | iOS | The device UUID. |
| **Android Version** | Both | OS version. The column keeps this label for iOS apps too. |
| **App Version** | Android | Version code of your app. |
| **App Version Name** | Android | Version name of your app. |
| **Emulator** | Android | Whether an emulator was detected. |
| **Rooting** | Android | **Rooted** or **Not Rooted**. |
| **Jailbreak** | iOS | Whether the device is jailbroken. |
| **Hacking Type** | Both | The threat category. |
| **Details** | Both | Detail message for the detection. |