Threat Check in Relay

Threat Check is a valuable tool to help administrators monitor and make informed decisions about activity on (and off) their network. This feature categorizes users into two groups: Watchlist and Review.


Users on the Watchlist are manually added by Relay administrators. Click on Threat Check > Watchlist to view, edit, and share this list.

Adding Users

Users added to the Watchlist are listed in alphabetical order. To add a user to this list, click the icon to open the Add to Watchlist window.

Enter the user’s name in the search box and mark the checkbox next to their name. Click Add to include the user on the list and return to the Watchlist page.

Tip: Save time and add multiple users to the list while the Add to Watchlist window is open. Search for (and select) multiple users to add users all at once.

After the Watchlist is populated with users, quickly find users by entering their name(s) in the search box above the list. Or click the sort icon to arrange the list in ascending (or descending) alphabetical order.

Stop Watching

To remove a user from the list, click the Stop Watching button.


Users on the Review list are added based upon proprietary algorithms that suggest users who may be at-risk for harmful or violent activity. Click on Threat Check > Watchlist to view, edit, and share this list.

Users List

Users auto-populated to the Review are listed alphabetically. Click the sort icon to sort the list (in ascending or descending alphabetical order), or enter a user’s name in the search box.


Select a user from the list then click the Watch button to move the user to the Watchlist.


Remove a user from the Review list by selecting the user’s name then clicking the Clear button. To remove every user on the list, click the drop-arrow (on the Clear button) then click Clear All.

User Information

The Watchlist and Review pages both include user-specific information based upon their on (and off) network activity.

Behavior and Location

User Information provides a summary of the user’s behavior summary and last-detected location. The behavior summary includes three icons ( Violence | Self-Harm | Other ) which indicate the number of instances for each behavior-incident.

The Last Location indicates the user’s location and time since that location was detected.


The Timeline includes a chronological list of the user’s incidents by date, time, and type (Reported, Search, Blocked, and Visit). Violent incidents also include a time duration. Click on any URL or blocked search keywords to learn more about the incident.

Report Incident

Threat Check is unique in that offline incidents can be reported on both the Review and Watchlist timelines.

Click the Report Incident icon to open the Report Incident window.

Choose an incident type, severity level, and enter the date of the incident then click Add.

User Details

Click the User Details icon, next to the user’s name, to open the User Information panel. Click here to learn more about the User Information panel in our Relay documentation.

Clear Timeline

Click the Clear Timeline icon next to the user’s name.

When prompted, click OK to confirm and clear the user’s timeline.


Click the Share button to open the Share Report window.

Then select a time until the shared link expires.

Click the Copy button (you can paste this link into an email or message as needed), or click Preview to view the report in a new browser tab.

Helpful Result?

Every incident on the user-timeline includes the Helpful Result? icons (except for Reported Incidents). Providing Relay with this kind of feedback helps us learn more about your organization’s threat concerns which provides you with more accurate results.

If the incident is helpful in understanding and analyzing the user’s behavior, click the check mark icon (). If the incident is not helpful, click the “X” icon ().


To set up Threat Check notifications, click Settings > Threat Check. Enter your email address or mobile phone number to receive Threat Check notifications.

When a student is added to the Review or Watchlist, a notification is sent to your mobile phone and/or email address.