How PuppetWatch works

Understand suspicious behaviour across actions, sessions and connected accounts.

Signals in context

• Activity patterns: unusual rates, timing and repeated actions.
• Account relationships: correlated behaviour across accounts and shared targets.
• Application context: the action, resource and target involved.

Coordinated activity

Actions that look ordinary individually can form a suspicious pattern across accounts. PuppetWatch correlates events to surface connected activity, such as repeated promotion of the same products by related accounts.

Responses within your limits

You choose the restrictions allowed for each application action. Available responses include monitoring, rate limiting, CAPTCHA and temporary action restrictions. PuppetWatch selects a response within those boundaries.

False positives and validation

Begin in monitor-only mode and review decisions against your own traffic before enabling enforcement. For a suspected false positive, request a detection review with your project and event reference.

Public benchmark results and a detailed validation protocol are not yet published. No accuracy or false-positive rate is claimed here.