See which sessions feel trusted, aging, or suspicious.

This map groups the recent audit window by device, IP bucket, and auth method, then scores each cluster so you can decide whether to keep it, watch it, or revoke it.