User Guide

1. What SignalsGuard does

SignalsGuard analyses the signalling traffic your network exchanges with other networks — SS7/MAP (2G/3G), Diameter (4G/LTE and IMS), GTP-C (mobile data sessions) and SIP (VoIP/IMS) — and shows where hostile signalling comes from, what it is trying to do, and whether your firewall stopped it.

2. Signing in & navigation

Signing in

Go to signalsguard.com/login.html and sign in with the email and temporary password from your welcome email, then change the password under My account. Passwords need 12+ characters with upper- and lower-case letters, a number and a symbol. After 20 failed attempts in 15 minutes sign-in pauses for 15 minutes.

Your session lasts up to 8 hours and belongs to the browser tab: closing the tab signs you out, and a new tab needs a new sign-in. Changing your password (or resetting it with Forgot password?) signs out every other session on your account; the tab where you changed it stays signed in.

Two-factor authentication (2FA)

2FA adds a 6-digit code from an authenticator app (Microsoft Authenticator, Google Authenticator, 1Password, Authy or similar) to your password. It is optional for analysts unless your organisation requires it, and mandatory for SignalsGuard administrators.

• Turn it on: My account → Two-factor authentication → Set up. Scan the QR code (or type the key shown under it), enter the code the app displays and press Turn on. If your organisation requires 2FA you are taken through the same steps straight after entering your password.
• Recovery codes: you then see 10 one-time recovery codes. Save them in your password manager or download the .txt — they are shown only once. Each code signs you in once if you lose your phone; type it in the code box instead of an app code.
• Signing in: after your password, enter the current code from the app. A code can only be used once; if it is rejected, wait for the next one. After 5 wrong codes in 15 minutes, 2FA sign-in for your account pauses for 15 minutes.
• New recovery codes / turning it off: under My account, enter your password and a current code, then Generate new recovery codes (old ones stop working) or Turn off (not available where 2FA is required).
• Lost your phone and your recovery codes? Email support@signalsguard.com from your work address. We verify your identity by phone before resetting 2FA; you then set it up again at your next sign-in.

If the app's codes are always rejected, check that your phone sets its clock automatically — codes depend on the time.

Live demo

Try the live demo on the homepage (or Explore live demo on the sign-in page) opens a read-only demo organisation with illustrative data for 2 hours. A banner marks demo sessions; nothing can be changed and AI reports are limited.

Roles

Navigation

The portal has four pages, each answering one question: Overview (are we under attack, and are our defences working?), Threat Intel (who is attacking operators like us, and how?), Compliance (are we compliant, and exactly what must we fix?) and Reports (a written brief to share). Admins also see Admin. The menu on the right holds My account, Help and Sign out. On a phone the navigation folds into the menu button. Press Esc to close any menu, drawer or pop-up.

3. Overview

Are we under attack, and are our defences working? Everything on it reflects your organisation's events in the period chosen in the header.

3.1 Header

3.2 Tiles

3.3 Needs attention

The first thing to act on, most serious first:

• Attack chain — attack chains SignalsGuard detected automatically (see below), with the sending element, the operation sequence, date range and confidence. Click to step through its events in the drawer.
• Critical · not blocked — critical events (techniques with no legitimate cross-network use, e.g. ATI, PSL, SLg PLR) that your firewall did not block, newest first (up to five; the rest are in All events). Click one to open it.
• Failing control — up to three controls with the most points lost; Fix on Compliance opens the prioritised fix list.
• Tagged campaign — events that share a campaign ID supplied by your firewall or feed (listed last; not counted in the tile).

Detected attack chains

Every time data arrives (portal upload, CSV, API or SFTP) SignalsGuard groups your events by the sending element — the SCCP calling GT, the Diameter Origin-Host or the source IP, in that order — and looks for the sequences below within a sliding 24-hour window. When none of those identifiers is supplied, events are grouped by source operator and country instead, and the chain's confidence is reduced, because one operator runs many nodes. Operation names are matched after normalisation, so any spelling your firewall uses is recognised.

Chains are built only from messages an attacker sends. Messages your own network generates in response — for example the CancelLocation your HLR sends to the genuine VLR after a rogue UpdateLocation — are not required. Normal traffic is not flagged: an SRI-SM followed by its MT-ForwardSM is ordinary SMS delivery, and authentication-vector requests for a single home network look like a serving VLR. Your own campaign IDs are never overwritten; an event that already carries one keeps it and is still listed in any chain it belongs to.

3.4 Events over time, map and all events

• Events over time — one stacked bar per day across the whole period (empty days shown as zero), split by severity. Hover for daily counts; use the legend to hide a severity.
• Threat origin map — a world map shaded by the number of events from networks registered in each country (darker → amber → red as volume rises; the legend shows the busiest origin). Hover for the count. Click a country to filter the whole page to events from that origin; click ✕ Clear filter or the country again to remove it. The All / SS7 / Diameter / GTP-C / SIP tabs recolour the map for one protocol.
• All events — open it for the full list, most recent first (up to 300; narrow the period or filter the map for more).

3.5 Event detail drawer

Click any event to open it. The drawer contains:

• Header — protocol, operation with its opcode / command code, the threat category and, for SS7, the FS.11 filtering category.
• What this attack does — the mechanics of the operation, the category meaning and what its FS.11 category implies for filtering.
• Sending network — country, network and any calling/called GT, Diameter Origin-Host or source IP supplied in your data.
• Event summary — the description from your firewall or analyst, timestamp and event ID.
• Confidence — detection confidence supplied with the event (n/a if none).
• Firewall disposition — blocked / monitored / alert, with what it means.
• Recommended action — operation-specific countermeasure, or the category's recommended controls.
• Control checks on this message — each check the platform ran (for example FS.11 Category 1, SMS sender consistency, SIM toolkit), its result, the reason in plain English and whether your firewall handled it correctly or missed it.
• Campaign and Related events — other events with the same technique or campaign; click one to jump to it.

4. Threat Intel

Who is attacking operators like us, and how? Figures combine your own events with the shared intelligence pool (the SignalsGuard vendor feed plus operators who have opted in to sharing). Other operators' private data never appears here.

4.1 Summary figures

Source networks scored (networks with 3+ events) · Origin countries · Events analysed · Critical events · STIX indicators available for export. Choose the period at the top (7 days to 12 months).

4.2 Global origins and pool activity

• Where hostile signalling comes from — pool events by origin country. The All / SS7 / Diameter / GTP-C / SIP tabs show one protocol; click a country to filter the tables below.
• Daily events in the shared pool — one point per day with the normal daily ceiling (mean + 2σ, dashed); red points are days above it.

4.3 Events by origin country and by protocol

Origin country columns: Country, Protocols seen from it, Events, Critical, and a Share bar (red when critical events are present). Click a country to filter the reputation table to its networks.

Protocol and severity is a matrix of protocol × severity counts with each protocol's share of events (the protocol mix). Click a protocol row to filter the reputation table and the map to that protocol.

4.4 Source network reputation

Click a column header to sort; type in Filter network or country or choose a protocol; Clear filters resets. Click a row for the network's detail: totals, every operation it used with its meaning, category and FS.11 class, and the recommended controls. Export CSV downloads the filtered table — useful for firewall allow/deny-list reviews.

4.5 Network lookup

Search an operator name or ISO country code across your events and the shared intelligence pool: event, critical, high and blocked counts, protocols, operations, first/last seen. Press Enter or Look up.

4.6 STIX 2.1 export

Indicators for source Global Titles (x-ss7-global-title), Diameter Origin-Hosts (x-diameter-origin-host) and IP addresses seen at least twice. Copy bundle or Download .json to load into a threat-intelligence platform, or pull it programmatically with an API key: GET /api/intelligence/stix-bundle. If the panel says there are no indicators, your exports do not yet include source_gt, origin_host or src_ip columns.

5. Compliance

Are we compliant, and exactly what must we fix? The page maps your events to the frameworks that apply to your organisation's registered country: GSMA FS.11 / FS.07 / FS.20 and GT-leasing guidance everywhere; UK Telecoms Security Regulations for GB (and Crown Dependencies, to be confirmed with your regulator); EU NIS2 for EU countries; FCC/CSRIC for the US. Admins open it for any organisation from Admin → Tenants → Registry & controls. The period selector at the top drives every section; Print / save as PDF produces a shareable copy.

5.1 Status

• Summary — overall risk (driven by critical events that were not blocked and by the defence score) with a short narrative.
• Defence score — the control-effectiveness score with each scored control's bar (see 5.4).
• Framework status — one row per applicable framework with its status; open it for its requirements. Every requirement that is not compliant lists the controls behind it and why.

5.2 What to fix — in priority order

Every failing or unreviewed control, with why it fails in plain English (e.g. “3 messages were let through: 3 × MAP-ATI — FS.11 Category 1 requires these to be blocked”), the events concerned (the link opens the Overview filtered to exactly those events), the specific fix, and which framework requirements it affects. Failing controls come first, then those needing review.

UK Telecommunications Security Code of Practice mapping (GB and Crown Dependencies) is shown as pending regulatory review until each control's mapping to a Code of Practice measure has been confirmed by a regulatory specialist. SignalsGuard does not cite measure numbers it has not verified.

5.3 Control register

Declare each control as implemented, partial, planned or not implemented, with an evidence note (rule-set version, pen-test date…). SignalsGuard combines the declaration with the evidence:

5.4 Network configuration, control checks and the defence score

Network registry

SignalsGuard validates each message the way a signalling firewall does: is this sender entitled to send this message about this subscriber? It needs two lists, uploaded as CSV under Network configuration (no subscriber data):

• Own ranges — kind, value, description with kind gt (your GT prefixes), imsi (your IMSI MCC+MNC), realm (your Diameter realms), ip (your GTP-C CIDRs) and sms_router (your SMS home router GTs).
• Roaming partners from IR.21 — partner_name, tadig, mcc_mnc, gt_prefix, diameter_realm, gtp_ip_range, roaming_agreement; one row per range, or several values in a cell separated by ;. roaming_agreement defaults to yes; set it to no for hubs or partners you do not roam with. A partner's mcc_mnc also matches 3GPP-format Diameter realms (epc.mncXXX.mccYYY.3gppnetwork.org).

An upload replaces the list (or appends to it); the last year of your events is then re-evaluated. Templates are on the page.

Control checks per message

Each event receives control findings: pass (legitimate for its sender), violation (should have been blocked), suspicious (should at least be alerted) or unverifiable (data missing — the reason is given). Your firewall's disposition then shows whether the control worked: a violation that was blocked is a correct outcome; a violation that was monitored or only alerted is missed; a legitimate message that was blocked is over-blocked. A control with missed checks is a failing control in Overview → Needs attention and in What to fix.

Authentication vectors (SAI / AIR) never contain the subscriber key Ki; their value to an attacker is impersonating the network and decrypting captured radio traffic.

Defence score

Blocking controls score the share of hostile messages handled correctly. Validation controls (Category 2, Category 3, S6a, GTP-C plausibility) score 60% hostile handled + 25% share of traffic that could be validated against your registry + 15% legitimate traffic not over-blocked. Controls with no traffic, or that cannot be evaluated, are left out and their weight is shared among the rest; the Overview shows the evidence coverage.

Technical detail

Open Technical detail for the attack distribution, the daily severity trend and findings by attack category: totals, block rate, trend, operations observed and recommended action.

6. Reports

Give me a written brief. Detection and scoring are deterministic statistics; the AI only writes the explanation and recommendations from the figures it is given. Always verify AI text before acting on it.

6.1 AI threat brief

Choose a preset — My network (your own events) or Global landscape (the shared pool: vendor feed, consenting operators and your own data) — and a period, then Generate report. Sections: executive summary, attack-chain analysis, sending-network assessment, regulatory exposure and technical recommendations. A brief for the same scope is reused for an hour (the header line says "cached" and when it was generated). Download PDF saves it.

6.2 Detections

Novel threat detection lists recent events (last 7 days) with label/opcode mismatches, TEID 0 on non-initial GTPv2 messages, first-time origins, SIP REFER from outside, sweeps of the same critical technique, or critical Diameter from sanctioned jurisdictions. When there are none, the page says so.

6a. My account, data sources & API keys

• Account details — email, organisation, role, status, member since.
• Organisation & usage — plan, registered country (drives the compliance frameworks), sharing status, events this month and in the last 30 days, latest event and last time data was received.
• Change password and Two-factor authentication — see section 2.
• Data sources & sharing — upload a firewall export (CSV or JSON, up to 25 MB; Enterprise plan) to analyse threats against your own network; the status line shows when the logs are processed and how many anomalies were found. The threat-sharing consent toggle is saved for your whole organisation: Private (default) keeps your events private and only anonymised, unattributed signal (source + technique) strengthens the shared view; Sharing lets your organisation's events join the shared pool that other clients' Threat Intel pages draw on, without identifying who was targeted.
• API access — create named keys (90 days, 1 year or no expiry). The key is shown once: copy it into your exporter. The table shows when each key was last used; Revoke stops it immediately.
• Team — everyone in your organisation, their role, 2FA status and last sign-in. Your organisation's administrator (the first user) can add colleagues, who are emailed their sign-in details, and remove them, which signs them out at once. Seats follow your plan.
• Your data & uploads — events stored, oldest and newest event, last data received, approximate storage, how long data is kept, a per-source breakdown, events per month, and every load (portal, API or SFTP) with rows loaded and rejected. Download my events exports up to 24 months as CSV (network identifiers only).
• Support & data requests — send a support question, a plan or billing question, or ask for a full export or deletion of your organisation's data. You get a reference (SG-xxxxxx) and a reply by email.
• Recent sign-in activity — your last 30 sign-ins and security changes with the IP address. Tell support about anything you don't recognise.

7. Sending data

7.1 Fields

Category and severity are always assigned by SignalsGuard from the operation, so the same technique is rated the same way whatever the source. Files containing msisdn, imsi, imei or cell_id columns are rejected by the portal upload — remove them first.

7.2 Ways to send

• Portal upload — My account → Data sources & sharing.
• REST API — POST /api/ingest/metadata with header X-API-Key, up to 1,000 events per request:

curl -X POST https://signalsguard-api-production.up.railway.app/api/ingest/metadata \
  -H "X-API-Key: sgk_YOUR_KEY" -H "Content-Type: application/json" \
  -d '{"events":[{"event_time":"2026-10-14T10:23:00Z","protocol":"SS7","operation":"SRI",
       "status":"blocked","source_country":"RU","source_operator":"RU mobile GT range",
       "source_gt":"79160000001","summary":"SRI from non-partner GT"}]}'

• SFTP drop box — ask support for credentials. Upload CSV/JSON/JSONL, optionally zipped or gzipped; files are checked and reviewed before they reach your Overview. See integration docs.

8. Admin console (SignalsGuard staff)

Open Admin from any page (admins only). The left menu switches views.

8.1 Overview

Counts of organisations, users, events (90 days, all organisations) and pending access requests, with the latest requests (approve/reject inline) and latest events.

8.2 Tenants (organisations)

Name, type, plan (with pilot end date), status, 2FA requirement, retention and created date; search and status filter. Edit changes plan, status (a suspended organisation cannot sign in), Require 2FA and event retention. View as opens the organisation's portal read-only for one hour, with a banner, after you give a reason; every view is written to the security log. API keys lists the organisation's keys and lets you revoke one. Registry & controls opens their Compliance page.

8.3 Users

Email, name, role, organisation, plan, 2FA and last login. Suspend signs the user out at once and blocks sign-in (Reactivate undoes it); Reset link emails a one-hour password-reset link; Reset 2FA after verifying the person by phone; Edit or Delete. Creating a user also creates their organisation if it does not exist, so they can see data immediately.

8.4 Access requests & onboarding

Requests from the homepage form show name, title, organisation, type, email, date and message. Approve does everything in one step: finds or creates the organisation, creates an analyst login linked to it with a strong random temporary password, marks the request approved and emails the welcome message. The password is also shown to you once — if the email failed, send it over a separate channel. Reject closes the request; Reply emails the requester from intelligence@.

8.5 Events

All organisations' events for 90 days with protocol, severity and demo/real filters. Columns: time, protocol, operation, severity, sending network, organisation and campaign, disposition, and source (DEMO = synthetic seed data, REAL = ingested; hover for the ingest source).

8.6 Data ingestion (SFTP)

Connection details

Host and port of the public SFTP endpoint (Railway TCP proxy), the server's host-key fingerprint (providers should verify it on first connection), the VirusTotal mode and whether staging storage is persistent. The server is a write-only drop box: providers can upload but not list, read or delete.

Creating a credential

1. + New SFTP Credential.
2. Provider name (becomes the username), organisation, optional Load uploads into organisation, auth type (generated password or the provider's SSH public key) and expiry.
3. Copy the connection block shown — the password appears once. Send it over a separate secure channel.

Example upload: sftp -P <port> <username>@<host> then put events.csv. Repeated failed logins from one IP are locked out with increasing delays.

Pending files — automated checks

Approve & load is enabled only when all checks have passed and finished. It parses the file, classifies every row, loads it into the chosen organisation, rebuilds that organisation's baseline, runs anomaly detection and deletes the staged file. Reject records a reason and deletes the file. Ingestion history shows each decision with rows loaded, anomalies found and any row errors.

8.7 Compose

Start a new email from any signalsguard.com mailbox. It is recorded in the Inbox, so the client's reply joins the same conversation.

8.8 Inbox

Every email to an @signalsguard.com address (admin, support, sales, intelligence and any other) and every request sent from a client's My account page, grouped into conversations. Each is linked to the client organisation automatically by the sender's address or domain (change it with the organisation selector). Open a conversation to read the full trail, view the formatted version (shown with scripts disabled) and download attachments. Send reply answers from the mailbox you choose with the earlier messages quoted underneath and a reference tag [SG-xxxxxx] in the subject, so replies thread correctly. Close files a resolved conversation; closed enquiries with no client account are deleted after 30 days, as the privacy policy says. Email still arrives in your normal mailbox as well.

8.9 Client activity and security log

Client activity lists each organisation's users (active in 7 and 30 days), 2FA uptake, last sign-in, last data received, events this month, API keys and open conversations, and flags feeds silent for 3+ days, organisations with no data yet and pilots not signing in. Security log shows sign-ins, failed attempts, 2FA and password events, admin actions and data exports for the last 12 months.

9. Threat categories

Every operation maps to one SignalsGuard category: A = attacks on subscribers, B = fraud and reconnaissance, C = attacks on the network itself.

10. GSMA FS.11 filtering categories (SS7)

Diameter is covered by GSMA FS.19 and GTP by FS.20; they do not use FS.11 categories.

11. SS7 / MAP operations

Code = MAP operation code. Aliases are other spellings the platform recognises.

12. Diameter operations

Code = Diameter command code.

13. GTP-C operations

Code = GTPv2-C message type.

14. SIP / IMS operations

15. Severity, disposition & scores

Severity (per event)

The platform's floor rating for a single event of that technique, from its baseline risk: critical no legitimate cross-network use (risk ≥0.9) · high sensitive, rarely legitimate from outside (≥0.75) · medium legitimate in context, dangerous if spoofed (≥0.55) · low mostly benign, matters in volume. Curated analyst events may be rated higher, never lower.

Firewall disposition

BLOCKED your firewall stopped it — good outcome · MONITORED allowed and logged; confirm the source is a partner or add a rule · ALERT not blocked and not reviewed; investigate.

Scores

• Defence score (posture score) — control effectiveness, sections 3.2 and 5.4.
• Reputation — section 4.4.
• Anomaly score — section 5.2.

16. Glossary