Concentrations
Devices and IPs carrying more than one identity, and national IDs seen more than once. Several names on one ID, or many identities on one device, is the shape of organised fraud. Each row opens a search for that signal; open a case from there to see its related attempts.
Flags
One attempt can fire several rules and counts under each, so these overlap and are not shares of a total.