What is Monocle?
Monocle is a traffic intelligence tool that identifies anonymized traffic such as VPNs, proxies, and datacenter connections, and provides insights into how users are connecting to your application.
Similar questions
What is a Monocle assessment?
A Monocle assessment is an encrypted payload generated for each session. It contains information about how a user is connecting, such as VPN usage, proxy detection, and anonymized status. You can decrypt and evaluate this data in your backend, or analyze it directly in the Monocle UI.
Does Monocle block traffic?
No, not by default. Monocle evaluates traffic and returns a decision (such as Block or Allow); your system is responsible for enforcing that decision. The exception is supported edge integrations, such as Cloudflare, where Monocle can enforce decisions directly.
What is the difference between using Monocle to monitor vs. enforce traffic decisions?
Monitor is passive: Monocle provides visibility into how users connect to your application without impacting users or taking any blocking action. Enforce applies actions such as blocking or allowing traffic based on Monocle's assessments. Most users start with a monitoring phase before configuring and enabling enforcement.
Why did I get a Monocle health email?
A Monocle health email means one of your Monocle applications has gone longer than its health threshold without traffic, which usually means Monocle is no longer installed or running correctly on that site or app. Only organization admins get these emails. Check that the integration is still in place, or, if the application is simply quiet, set a longer threshold under Alert after on the application's Settings page. Admins can turn the email off for an application in the same Notifications section, or for themselves on their Profile page. See Understanding Monocle Application Health Status.
Do I need a backend to use Monocle?
No. You can use Monocle to gain visibility into traffic intelligence via the Monocle UI without acting on it. With a supported integration like Cloudflare, traffic can be enforced directly from the UI based on policy configuration. A backend is only required if you want to decrypt assessments or apply custom enforcement logic.
Related guides & explainers
Understanding Monocle Application Health Status
Each Monocle application shows a health status dot indicating whether it's actively sending traffic. Learn what each color means, how to set each application's health threshold, how health alert emails work, and what to check if an application goes quiet.
Expanding IP and Service Rows in the Explorer
Click any IP or service row in the Monocle Explorer's breakdown tables to expand an inline detail panel, without leaving the table.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Context API Chrome Extension
Install Spur's Context API Chrome Extension to look up IP enrichment data directly from any web page — highlight an IP and get results inline, without leaving your browser. This is a developer-mode tool, not a Chrome Web Store listing.