Settings Reference

Settings Reference

This page explains every user-configurable setting in plain language. Each item includes what it controls during scanning and what changes when you increase, decrease, enable, or disable it.

Global Scan Controls

• Scanning enabled (default true): This is the master on/off switch for active scanning. Turning it off stops new scan collection until you turn it back on.
• Wi-Fi enabled (default true): This controls whether Wi-Fi observations are collected and checked against Wi-Fi rules. Turning it off removes Wi-Fi alerts and reduces battery use from Wi-Fi scanning.
• Bluetooth enabled (default true): This controls whether Bluetooth observations are collected and checked against Bluetooth rules. Turning it off removes tracker and Bluetooth alerts until re-enabled.
• Cellular enabled (default true): This controls whether cellular serving data is collected and checked against cellular rules. Turning it off removes cellular anomaly alerts and related measurement updates.
• GPS enabled (default true): This controls whether GPS integrity checks run while scanning is active. Turning it off disables GPS manipulation and location-quality alerts.
• Scan power profile (default normal): This selects the scan cadence profile used by background scanning. low_power reduces work and battery use but can miss short-lived events.
• GPS coordinate format (default lat_lon): This changes how coordinates are displayed in the user interface and exports. Switching formats improves readability for different workflows but does not change detection logic.

GPS Options

• location_update_interval_ms (default 3000): This sets how often GPS samples are evaluated. Lower values react faster but use more battery, and higher values save battery but can miss short events.
• impossible_speed_steady_delta_mps (default 4.0): This sets how much reported speed may change while still being treated as steady motion. Lower values are stricter and can alert more often, while higher values are more tolerant.
• impossible_speed_mismatch_factor (default 2.2): This controls how large the distance mismatch must be before impossible-speed logic triggers. Higher values reduce sensitivity, while lower values increase sensitivity.
• impossible_speed_min_distance_meters (default 800.0): This sets the minimum travel distance required before impossible-speed checks can alert. Raising it filters out short movements, while lowering it allows earlier detection.
• impossible_speed_min_mismatch_meters (default 250.0): This sets a minimum absolute mismatch distance before alerting. Higher values reduce small-noise alerts, while lower values catch smaller inconsistencies.
• impossible_speed_accuracy_improvement_meters (default 5.0): This requires position accuracy to improve before impossible-speed alerting is trusted. Higher values demand clearer improvement, while lower values allow alerts with smaller accuracy change.
• max_accuracy_for_movement_alerts_meters (default 120.0): This limits movement-based checks to samples with acceptable location confidence. Lower values are stricter about quality, while higher values allow noisier samples into movement checks.
• satellite_shift_distance_meters (default 1000.0): This sets the minimum position jump considered for satellite-shift consistency checks. Raising it ignores medium jumps, while lowering it checks smaller jumps too.
• satellite_shift_speed_mps (default 60.0): This sets the speed floor required for satellite-shift mismatch checks. Higher values focus on extreme movement, while lower values make the rule trigger on slower movement patterns.
• satellite_shift_window_ms (default 20000): This defines how close in time samples must be for satellite-shift comparison. A larger window is more permissive, while a smaller window demands tighter timing.
• altitude_jump_min_vertical_meters (default 120.0): This sets the minimum vertical jump needed for altitude-jump alerts. Raising it reduces sensitivity, while lowering it catches smaller vertical spikes.
• altitude_jump_max_horizontal_meters (default 25.0): This sets the maximum horizontal movement allowed when evaluating an altitude-only jump. Lower values are stricter and reduce false positives from real travel, while higher values are more permissive.
• network_divergence_min_distance_meters (default 300.0): This sets how far GPS and network location must separate before divergence counting starts. Higher values require bigger disagreement, while lower values flag smaller disagreements.
• network_divergence_max_accuracy_meters (default 100.0): This sets the worst acceptable accuracy for samples used in divergence checks. Lower values require cleaner samples, while higher values accept noisier samples.
• network_divergence_sync_window_ms (default 30000): This sets the maximum time difference between GPS and network samples for comparison. A wider window allows looser pairing, while a narrower window requires closer timing.
• network_divergence_min_consecutive (default 3): This sets how many back-to-back divergent samples are required before alerting. Increasing it reduces noise, while decreasing it alerts sooner.
• missing_field_min_samples (default 3): This sets how many repeated missing-field samples are needed before missing-field alerts fire. Higher values require persistence, while lower values trigger faster.
• poor_gps_min_accuracy_meters (default 80.0): This sets how inaccurate a fix must be before it counts as poor GPS quality. Higher values make the check less sensitive, while lower values make it more sensitive.
• poor_gps_max_used_in_fix (default 3): This sets the maximum number of satellites used in a fix before poor-signal logic stops counting that sample as weak. Lower values are stricter, while higher values allow more used satellites in weak-signal classification.
• poor_gps_max_average_cn0_db_hz (default 18.0): This sets the maximum average satellite signal-quality number (C/N0) for poor-signal tracking. Lower values are stricter, while higher values classify more low-quality samples as poor signal.
• poor_gps_min_samples (default 3): This sets how many poor-quality samples in a row are needed before alerting. Increasing it lowers noise, while decreasing it alerts sooner.
• mock_alert_cooldown_ms (default 120000): This sets the wait time before another mock-provider alert of the same type can fire. Longer cooldowns reduce repeated alerts, while shorter cooldowns show every repeat sooner.
• movement_alert_cooldown_ms (default 300000): This sets the repeat delay for movement-based GPS alerts. Increasing it reduces alert frequency, while decreasing it increases alert frequency.
• altitude_alert_cooldown_ms (default 600000): This sets the repeat delay for altitude-jump alerts. Longer values reduce repeated notifications, while shorter values increase responsiveness.
• network_divergence_alert_cooldown_ms (default 600000): This sets the repeat delay for divergence alerts. Higher values suppress repeats for longer, while lower values allow faster repeat alerting.
• missing_field_alert_cooldown_ms (default 1800000): This sets the repeat delay for missing altitude and missing vertical-accuracy alerts. Longer values reduce reminder noise, while shorter values provide tighter monitoring feedback.
• poor_gps_alert_cooldown_ms (default 600000): This sets the repeat delay for poor signal or jamming-style alerts. Higher values lower alert frequency, while lower values increase alert frequency.

Bluetooth Options

• tracker_window_ms (default 7200000): This is the main time window used to judge following behavior over movement. A longer window captures slower patterns, while a shorter window focuses on recent behavior.
• tracker_presence_window_ms (default 2700000): This is the time window for nearby-persistence checks when full following criteria are not met. Increasing it favors long persistence, while decreasing it favors immediate presence.
• tracker_alert_cooldown_ms (default 5000): This is the fallback delay before a tracker alert type can fire again. Longer cooldowns reduce repeated alerts, while shorter cooldowns allow rapid repeat alerts.
• airtag_follow_alert_cooldown_ms (default -1): This sets AirTag-follow cooldown when explicitly configured for that family. -1 uses the fallback tracker cooldown, while custom values override that behavior.
• findmy_follow_alert_cooldown_ms (default -1): This sets Apple Find My follow cooldown when explicitly configured. -1 uses fallback cooldown, while a positive value creates family-specific pacing.
• airtag_presence_alert_cooldown_ms (default -1): This sets AirTag nearby-persistence cooldown when explicitly configured. -1 uses fallback behavior, while custom values change how often repeated presence alerts appear.
• findmy_presence_alert_cooldown_ms (default -1): This sets Apple Find My nearby-persistence cooldown when explicitly configured. -1 means fallback behavior, while custom values set family-specific repeat spacing.
• tracker_min_samples (default 5): This sets the minimum sightings needed before following logic can alert. Higher values reduce noise from brief sightings, while lower values react faster.
• tracker_min_duration_ms (default 1800000): This sets the minimum observation duration required for following alerts. Raising it requires longer persistence, while lowering it catches shorter following windows.
• tracker_min_travel_meters (default 250.0): This sets how far you must travel before follow logic is considered valid. Higher values reduce static-location noise, while lower values trigger during shorter trips.
• tracker_min_displacement_meters (default 120.0): This sets the minimum straight-line displacement for following checks. Higher values require more clear movement, while lower values allow alerts with less movement.
• tracker_min_distinct_locations (default 3): This sets how many distinct location buckets are required for follow evidence. Increasing it strengthens evidence quality, while decreasing it makes alerts faster.
• tracker_location_bucket_meters (default 120.0): This sets the size of each location bucket used to count distinct places. Larger buckets merge nearby points, while smaller buckets separate them.
• tracker_max_location_accuracy_meters (default 75.0): This sets the worst acceptable location quality for follow logic samples. Lower values are stricter and cleaner, while higher values allow noisier samples.
• tracker_nearby_rssi_threshold_dbm (default -85): This sets the Bluetooth signal-strength threshold used to count a device as nearby in follow logic. A higher threshold (closer to zero) is stricter for proximity, while a lower threshold includes weaker and farther signals.
• tracker_min_nearby_samples (default 3): This sets how many nearby-strength samples are required for follow alerts. Increasing it reduces false positives, while decreasing it increases sensitivity.
• tracker_time_bucket_ms (default 600000): This sets the bucket size for time-distribution checks in follow logic. Larger buckets smooth time evidence, while smaller buckets demand tighter repeated timing.
• tracker_min_time_buckets (default 3): This sets how many different time buckets must contain evidence. Higher values require broader time spread, while lower values allow shorter events.
• tracker_presence_min_samples (default 2): This sets the minimum sightings for nearby-persistence alerts. Higher values reduce single-hit noise, while lower values trigger sooner.
• tracker_presence_min_duration_ms (default 60000): This sets the minimum nearby duration before nearby-persistence alerting. Higher values require longer nearby presence, while lower values permit faster alerts.
• tracker_presence_nearby_rssi_threshold_dbm (default -92): This sets the signal-strength threshold for nearby-persistence checks. Higher thresholds focus on closer devices, while lower thresholds include weaker signals.
• tracker_presence_min_nearby_samples (default 1): This sets the minimum nearby-strength samples for nearby-persistence logic. Increasing it requires stronger repeated evidence, while decreasing it is more permissive.
• tracker_presence_time_bucket_ms (default 60000): This sets the time bucket size for nearby-persistence evidence. Larger buckets are more forgiving over time, while smaller buckets are more strict on timing.
• tracker_presence_min_time_buckets (default 1): This sets how many time buckets must contain nearby-persistence evidence. Higher values require longer spread in time, while lower values allow immediate alerting.

Wi-Fi Options

• strong_signal_threshold_dbm (default -55): This sets the signal-strength threshold for strong Wi-Fi signal alerts. A higher threshold focuses on very close devices, while a lower threshold includes farther devices.
• persistent_window_ms (default 120000): This sets the rolling time window used for persistent-signal checks. A longer window captures slower persistence, while a shorter window reacts faster.
• persistent_min_samples (default 4): This sets the minimum number of samples required before persistent-signal logic can alert. Increasing it reduces noise from brief bursts, while decreasing it increases sensitivity.
• persistent_rssi_delta_db (default 5): This sets how stable signal strength must be to count as persistent. Lower values require tighter stability, while higher values allow more variation.
• persistent_min_duration_ms (default 60000): This sets the minimum duration required for persistent-signal alerts. Higher values require longer persistence, while lower values alert sooner.
• strong_signal_min_travel_meters (default 100): This sets how far you must move before strong or persistent Wi-Fi alerts can re-fire for the same device. Higher values suppress repeat alerts during small movement, while lower values allow faster repeats.
• sequential_oui_enabled (default false): This enables detection for watched OUI sequences appearing close together in time. Turning it on increases pattern coverage, while keeping it off avoids extra noise in dense environments.
• sequential_oui_window_ms (default 120000): This sets the time window used when sequential OUI detection is enabled. Larger windows are more permissive, while smaller windows are stricter.
• multi_ssid_enabled (default false): This enables the rule that checks one hardware address advertising multiple network names in a short period. Turning it on catches this behavior pattern, while leaving it off avoids common enterprise noise.
• multi_ssid_window_ms (default 600000): This sets the time window for multi-SSID checks when enabled. Larger windows catch slower pattern changes, while smaller windows only catch rapid changes.
• enable_band_mismatch (default true): This enables checks for expected band behavior mismatch on known identities. Turning it off removes those consistency alerts if they are noisy in your environment.
• enable_security_mismatch (default true): This enables checks for expected security setting mismatch on known identities. Turning it off suppresses those alerts, which may reduce noise but also reduce downgrade visibility.
• geiger_min_rssi_dbm (default -100): This sets the minimum signal value shown in Wi-Fi locate/geiger views. Higher values hide weak signals for cleaner proximity work, while lower values show more of the environment.
• geiger_band_filter (default all): This limits the geiger view to selected Wi-Fi bands. Narrow band selection can simplify close-range hunting, while all gives full-band visibility.

Cellular Options

• signal_observation_distance_meters (default 100): This sets travel distance required before some repeat cellular signal alerts can fire again for the same device context. Larger values reduce repeat frequency, while smaller values allow repeated alerts sooner.
• lac_difference_threshold (default 10): This sets the area-code jump size needed for LAC/TAC jump alerting. Increasing it reduces sensitivity to small transitions, while decreasing it makes jump alerts easier to trigger.

Rooted Options

• These settings are only active when rooted features are enabled, and they control deeper radio-log diagnostics. For practical usage guidance and why each rooted capability matters, see Rooted Features.

• enabled (default false): This is the master switch for rooted detection features. Turning it on enables rooted-only checks, and turning it off disables all rooted-only checks.

• poll_interval_ms (default 20000): This sets how often rooted diagnostics polling runs. Lower values react faster but use more resources, while higher values reduce load but may miss short artifacts.

• silent_type0_sms_enabled (default true): This enables rooted detection for silent type-0 SMS artifacts in logs. Turning it off disables this rooted alert family entirely.

• silent_type0_sms_log_tail_lines (default 300): This sets how many recent radio-log lines are scanned each poll for silent SMS markers. Higher values improve context coverage, while lower values reduce processing.

• silent_type0_sms_alert_cooldown_ms (default 60000): This sets repeat delay for silent type-0 SMS alerts. Longer cooldowns reduce repeated noise, while shorter cooldowns show repeats quickly.

• cell_reject_reason_enabled (default true): This enables rooted reject-reason extraction from logs. Turning it off disables rooted reject-cause alerting.

• cell_reject_log_tail_lines (default 300): This sets how many recent radio-log lines are scanned for reject reasons. Higher values capture more context, while lower values are lighter and faster.

• cell_reject_alert_cooldown_ms (default 60000): This sets repeat delay for rooted reject-cause alerts. Larger values reduce notification noise, while smaller values increase repeat visibility.

• traffic_channel_lock_enabled (default true): This enables checks for movement while channel identity appears pinned too long. Turning it off disables this rooted lock-style anomaly check.

• traffic_lock_min_samples (default 10): This sets the minimum repeated same-channel samples needed before lock analysis can alert. Higher values require stronger evidence, while lower values react sooner.

• traffic_lock_min_duration_ms (default 600000): This sets the minimum pinned duration required for traffic-channel lock alerting. Increasing it favors long-duration confidence, while decreasing it catches shorter lock periods.

• traffic_lock_min_movement_meters (default 1500.0): This sets how much movement must occur while channel identity remains pinned. Higher values reduce false positives, while lower values increase sensitivity.

• traffic_lock_max_location_accuracy_meters (default 120.0): This sets the maximum allowed location uncertainty for channel-lock analysis. Lower values demand cleaner location confidence, while higher values allow noisier samples.

• traffic_lock_alert_cooldown_ms (default 1800000): This sets repeat delay for traffic-channel lock alerts. Longer cooldowns reduce repeated reminders, while shorter cooldowns increase repeat alerting.

Device List and Rule Management Settings

• Device Alert Settings: This section stores device identities and patterns that should alert. More specific entries improve precision, while broad entries increase total alert volume.
• Ignored Devices Settings: This section stores identities and rules you do not want to alert on. It reduces noise, but broad ignore entries can hide meaningful behavior.
• Whitelisted (expected) Device Settings: This section stores expected identity relationships for known-safe devices. A maintained whitelist reduces false positives, while stale entries can create mismatch alerts.
• Rule severity editing: Each rule can be set to high, medium, low, or off in domain option pages. Raising severity changes how prominently alerts appear, while off disables that rule.

Import, Export, and Offline Data Settings

• Import Lists target: This chooses which list receives imported entries. Correct target selection avoids writing trusted data into the wrong list.
• Import Lists mode (merge or overwrite): Merge keeps current entries and adds imported entries, while overwrite replaces the target list. Merge is safer for incremental updates, and overwrite is better for full reset from a known file.
• Export Lists selection: This chooses one or more list types to export in one action. Exporting all lists regularly gives fast recovery points if tuning mistakes happen.
• Export Log CSV: This writes alert timeline and context in table form for spreadsheet review. It is easier for counting and filtering than map-based formats.
• Export Log KMZ: This writes alert timeline and location in map-ready compressed format. It is better for route replay and location pattern review.
• OpenCellID import: This imports offline cellular reference files for unknown-tower checks. A larger imported dataset improves local coverage and reduces false unknowns.
• Clear OpenCellID database: This removes imported offline cell reference data from local storage. After clearing, unknown-tower checks rely only on live observations until data is imported again.