# Type

### `event.type`  <mark style="color:blue;">enum</mark>

The type of an [Event](https://dfend.gitbook.io/documentation/developer-api/types/event). Types coincide with [Levels](https://dfend.gitbook.io/documentation/developer-api/types/event/level) and [Recommendations](https://dfend.gitbook.io/documentation/developer-api/types/event/recommendation).

{% hint style="info" %}
Configure the Event types you receive and the criteria under which they are triggered in **Dashboard** under [Setup > Policies](https://dashboard.dfend.app/dashboard/setup/policies).&#x20;
{% endhint %}

### Possible values

For convenience, we have noted the [Level](https://dfend.gitbook.io/documentation/developer-api/types/event/level) of each type next to its value.

#### BAD\_ACTOR   <mark style="color:red;">**`CRITICAL`**</mark>

User's IP has been recognized as a bad actor.

#### BAD\_DEVICE   <mark style="color:red;">**`CRITICAL`**</mark>

User's account is being accessed from a device was previously rejected by the user.

#### FAILED\_LOGINS\_EXCEEDED   <mark style="color:red;">**`CRITICAL`**</mark>

User has exceeded the max failed logins within a given time period.

#### IMPOSSIBLE\_TRAVEL   <mark style="color:red;">**`CRITICAL`**</mark>

User could not have traveled between two received locations at a realistic speed.

#### NEW\_DEVICE   <mark style="color:orange;">**`WARNING`**</mark>

User is on a device we've never seen before.

#### NEW\_LOCATION   <mark style="color:orange;">**`WARNING`**</mark>

User is at a location we've never seen them at before (city or region).

#### VPN\_SWITCH   <mark style="color:orange;">**`WARNING`**</mark>

User is using a VPN provider that they haven't used before.

#### TOR\_SWITCH   <mark style="color:orange;">**`WARNING`**</mark>

We haven't seen this user on Tor network, but now they are on it.

#### CARRIER\_SWITCH   <mark style="color:orange;">**`WARNING`**</mark>

User is on a mobile carrier network that they haven't used before (only triggered along with NEW\_DEVICE or IMPOSSIBLE\_TRAVEL).

#### IP\_MANY\_IDENTITIES   <mark style="color:orange;">**`WARNING`**</mark>

Many different users have logged into your app from the same IP.

#### IP\_SIMILARITY   <mark style="color:orange;">**`WARNING`**</mark>

User's IP address is numerically dissimilar from others they have used.

#### COMPROMISED\_PASSWORD   <mark style="color:orange;">**`WARNING`**</mark>

User logged into an account using a known compromised password while using Chrome browser or ChromeOS (via Google Workspace integration).

#### NEW\_IDENTITY   <mark style="color:blue;">**`INFO`**</mark>

We created a new DFend Identity for one of your users.

#### IDENTITY\_OPTED\_IN   <mark style="color:blue;">**`INFO`**</mark>

A user has opted into DFend (and added contact information for verifications).

#### IDENTITY\_OPTED\_OUT   <mark style="color:blue;">**`INFO`**</mark>

A user has opted out of DFend.

#### USER\_INVOLVEMENT\_RESPONSE   <mark style="color:blue;">**`INFO`**</mark>

User has responded to a verification request using a DFend embedded link.

#### USER\_INVOLVEMENT\_EXPIRED   <mark style="color:blue;">**`INFO`**</mark>

User didn't respond in a given time period. Take further action.