> For the complete documentation index, see [llms.txt](https://docs.oort.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/rare-browser-activity.md).
# Rare Browser Activity
Detects users logging in from rare and unusual browsers that are on your blocklist, or not on your allow list.
Rare browser activity can be a security issue due to the latency of applying patches to those browsers. It also may indicate that a specific browser differs from what is typically utilized by the actual end user, which could highlight anomalous behavior that should be investigated.
Device prevalence is the percentage of active user-days over the past 90 days, within each integration instance, that include a successful event from a given browser, user agent and OS combination. Events where the browser, user agent and OS are all empty are excluded. The 'Device prevalence threshold' setting is this percentage, and determines what the Auto-discovery setting considers rare.\
\
The Auto-discovery setting, which is disabled by default, will detect rare browsers if the device prevalence is less than 0.5% \[default].
**Recommended Actions**
Please review the activity of users tracked with a rare browser. Evaluate the user alongside other security anomalies like new locations or login failures. You can exclude this user from the check or add the browser to your allowed list.
**Check Settings & Defaults**
Auto-Discovery of Rare Browsers: false
Device Prevalence Threshold (%): 0.5
Blocklist: 28
Ignore List: empty
**Compatibility**
[AWS](/integrations/aws.md)
[Duo](/integrations/duo-security-integration.md)
[GitHub](/integrations/github.md)
[Microsoft Entra ID](/integrations/azure-active-directory-integration.md)
[Okta](/integrations/okta-data-integration.md)
[Salesforce](/integrations/salesforce-integration.md)
