Elements
Introduction
Elements are the core data fields that make up every Event in the Spec Hub. They represent the individual pieces of information — such as an email address, device fingerprint, or transaction amount — that are captured, normalized, and analyzed throughout the Spec Platform. Elements provide semantic meaning behind raw data, enabling powerful linking, aggregation, and behavioral analysis across Sessions and Events.
Elements, the final row, are the building blocks of Events and Sessions!
Data
There are two primary types of elements: Entities and Attributes. Elements are a named and normalized collection of data. The Spec Platform creates a clean and comprehensive dataset from the beginning.
Entities
These are linking data, such as user IDs, device fingerprints, or account numbers. Entities are used to connect events and sessions, enabling aggregation, co-occurrence analysis, and behavioral linking across the Hub.
The Event Timeline shows primary elements for each Event. These are frequently used Elements that many business applications have in common. The Event Inspector will show all Elements that were recorded on the Event including custom data Elements.
Attributes
These are descriptive data, such as browser type, transaction value, or geolocation (latitude and longitude). Attributes provide context for analysis but do not drive linking between Events or Sessions.
Analysis
The Event Timeline shows many of the Elements at the forefront of investigation. To view all of values on an Event, including all attributes and custom elements, click the popout link in the Event Timeline to navigate to the Event Inspector.
Types
Each element has both a complex value type and a simple value type.
Complex value types include structured data like addresses, payment accounts, and email addresses. For example, an address element is stored as a collection of street, city, region, postal code, and country. Without enough information to build the address, the complex element will be empty. You can see the component elements in the Event Inspector to investigate why the address was incomplete. Email addresses are a single element, but their value is validated as a proper email address and normalized.
Here are a set of examples showing the element type labeling and categorizations that the platform performs behind the scenes.
| Type | Description |
|---|---|
| Session Risk Rating | Normal, Suspicious, or Malicious |
| Address | Structured object with fields like street, city, region, postal_code, country, latitude, longitude |
Must look like a valid email address, me@specprotected.com | |
| Phone Number | Digits only, with formatting characters stripped |
| Payment Type | Type of payment (e.g., "credit_card", "checking") |
| Country | Valid country name or abbreviation |
| Currency | Valid currency abbreviation (e.g., "USD") |
| IP Address | Valid IP address string |
| Month | Number from 1 - 12 |
| Year | Number from 1 - 12 |
note
Please note that the table above is not meant to be an exhaustive list as the details behind these value types is contained within the Spec Platform.
Simple value types are strings, numbers, and booleans. These are used for straightforward data like names, money amounts, or flags. Complex types contain values with simple types, but give these simple types more context. For example, country codes are compared case-insensitively and as two-character codes, despite all country codes being a simple string type and the fact that country codes can be read from network data in a variety of formats. The end result is a conversion to a standard, cleaned, and normalized data element.
Elements in the Hub
The Hub supports over 200 elements, each with a specific value type and normalization logic. As data is ingested, element values are normalized according to their type, ensuring that all data is cleaned and standardized in the data warehouse prior to storage.
Elements are labeled with human-readable names for clarity in the UI, such as “Email,” “Shipping Address,” or “Payment To Account Number.” Sensitive elements, like payment account numbers, are hashed to comply with PCI requirements and other data protection standards. Elements are the foundational pieces of Events as they are the data points that are recorded when the Event is observed.