Read Signatures

A read signature describes what normal reads look like at one read point. You teach Tagnet by recording a capture of representative scan events from a read point, then building a signature from it. Once you turn on matching, Tagnet compares each new scan event with the signature and shows which tags read unusually, such as an unexpected signal strength, a dwell time that is too long or too short, or a tag that hardly moves when it normally would. There are no thresholds to hand-tune.

Note: Read Signatures is the Read Signatures tab of the Scan Events page (/scan-events/signatures) and is marked Experimental in the app. The underlying statistics engine is stable, but the feature is still evolving; expect it to change in future releases.

Read Points

A read point is the place Tagnet compares events at: either a device group, or a reader that is not in a group. A grouped reader's events are keyed by its group, so for a grouped reader the group is the read point. An ungrouped fixed reader is its own read point and works exactly like a group: it can start a capture, finish it, build a signature, use it, and have its events compared with it.

Note: A read point here is not the same thing as a device's Read point location, which is the place in your location hierarchy that Move Inventory actions use. A read point for signatures is the reader or group whose scan events are being compared with a signature.

Where a signature is in use is a pointer on the read point, not a setting on the signature:

• A read point uses at most one signature at a time.
• One signature can be in use at several read points at once. If 25 sites have the same reader setup, they can all use one signature captured at one of them.
• Each signature remembers where it was captured. That is provenance only: it does not limit where the signature can be used.

Overview

The read signature workflow has four stages:

1. Capture: Record representative scan events at a read point during normal operations
2. Build: Create a signature from the capture. You tick what should count as an unusual read and pick how different a read must be, and Tagnet shows how the signature scores against its own capture before you save
3. Use: Use the signature at a read point so incoming scan events there are compared with it
4. Review: Open the mismatches in the Scan Events list and investigate the unusual reads

From the Read Signatures page you can:

• See every read point in one list, with where it is in setup and how its reads matched in the last 7 days
• Start and manage captures
• Build signatures, choosing which checks flag a tag and how strict they are
• Open a signature to see what a normal read looks like and how this week's reads compare
• Use, stop using, and delete signatures, including applying one signature to several read points
• Jump to the scan events that did not match

Permissions

Permission	What It Allows
View Scan Events	Access the Read Signatures page and view signature data
Admin role	Start, finish, and discard captures; build, use, stop using, and delete signatures

Users without the Administrator role see Open on every row instead of Set up, Finish capture, or Build signature.

Note: The Scan Events page, including this page, is hidden from the Operator role by default. See Users, Roles & Access Scopes for role permissions.

The Read Signatures List

The list has one row per read point. There is no separate signatures view: you reach a signature through the read point that uses it. Use the search box to find a read point by name, description, or the name of the signature it uses.

Column	Description
Read point	Icon, name (linked), and description. The icon shows whether it is a device group or a reader.
Status	A coloured dot with two lines of words: the state, then a detail line
Signature in use	The signature name, then Captured here or Shared from the read point it was captured at
Last 7 days	The percentage of events that matched, then N mismatches or No mismatches. Shows Nothing compared when no events were compared in the last 7 days.
Scope	Access scope (when multiple scopes active)
(action)	One button that depends on the state

Status and Actions

Every read point is in one of these states. The status words and the action button are the same on the list, in the read point workspace, and on the device and group pages.

Status	Detail line	Action
Not set up	Matching is off	Set up
Capturing	N of about 25 passes so far	Finish capture
Capture finished	N events, ready to build a signature	Build signature
Matching off	N signatures built here, none in use	Open
Matching on	N events compared in 7 days (or "No events to compare in 7 days")	Review N mismatches when there are mismatches, otherwise Open
Settings changed	Reader no longer has the captured settings; its reads are not compared	Capture again (administrators)

Set up, Finish capture, Build signature, and Capture again need the Administrator role. Other users see Open. Review N mismatches appears in a warning colour and opens the Scan Events list (see Reviewing Mismatches).

Settings changed replaces Matching on when a reader at the read point no longer has the settings the signature was captured under. It appears in a warning colour. See What a Signature Was Captured Under.

Open a read point's workspace from its row. A device group's workspace is at /read-signatures/groups/{id}, and an ungrouped reader's is at /read-signatures/devices/{id}. If you open the device address for a reader that is in a group, Tagnet shows a notice pointing you to the group's workspace, because the group is that reader's read point.

If no read points are available, the list says so and links to Devices.

The Read Point Workspace

The workspace has no tabs. It shows one section, always titled Signature matching, for the read point's current state; the header icon shows whether the read point is a device group or a reader. The section opens with these fields:

• Matching: a chip that reads Off, On, or, in amber, On, but N reader's settings changed (or readers' for several) when a reader no longer has the settings the signature was captured under.
• Signature in use: the signature, linked to its page, or None.
• Stage: shown only while matching is off. It reads Not set up, Capturing, Capture finished, ready to build, or Built, not in use.

Below the fields, the section shows the text and buttons for the current state.

The steps themselves (capture, build, turn on matching) live in the set-up wizard, described under Setting Up a Read Point. The workspace shows where the read point is and offers the one action that moves it along:

State	What the section shows
Not set up	A short explanation, Set up (opens the wizard), and Use a signature from another read point
Capturing	The pass count so far and when the capture started, Continue setup (back into the wizard, where the count updates live), and Discard capture
Capture finished	The capture's event count, and Continue setup (the wizard resumes at the build step)
Built, not in use (matching off)	A reminder that signatures were built here but none is in use, with a way to use one below or Capture again
Matching on	Where the signature was captured and when it was built, View signature, Recapture, Turn off matching, four summary tiles, and a link to the Scan Events list. If a reader's settings changed, a warning alert headed Settings changed on {reader} (or on N readers) lists what differs

Below the panel are two collapsible sections: Use a signature from another read point, and Captures and signatures here, which holds the history. Both are described under Managing Signatures.

Setting Up a Read Point

Set up on a read point's row, card or workspace opens the set-up wizard at /read-signatures/setup. It has three steps, shown across the top like the reader setup wizard: Capture passes, Tune, Build and use. Nothing is written until the last step. The wizard needs the Administrator role. It resumes from wherever the read point is: a running capture shows its live count, and a finished capture that nothing was built from is preselected. Cancel or Back to read point leaves at any time without losing a capture.

Step 1: Capture Passes

Either start a new capture or pick one made here before, then click Next.

To start one:

1. Optionally enter a capture name. If you leave it blank, Tagnet names the capture after the read point and the date.
2. Click Start capture.
3. Run normal passes through the read point: whatever usually passes, at the usual speed. Aim for 20 to 30. The pass count and the progress bar update every few seconds.
4. Click Finish capture. The finished capture is now the chosen one.

Important: Matching is off at this read point while a capture runs, so its reads are not compared with a signature.

• Minimum 10 passes are required before Finish capture is enabled; the step says how many it still needs. Fewer passes make a signature that is mostly one or two passes' doing. More passes make a steadier signature, and 20 or more is ideal. A capture finished with fewer than 10 passes (before this minimum) is listed as too few to build.
• A capture should record normal, expected behavior. Avoid capturing during unusual conditions.
• Discard capture throws the running capture away; a discarded capture cannot be used to build a signature.

To reuse a capture, pick it under Or use an existing capture: every finished capture at the read point is listed with its event count and when it finished. A capture has one of three statuses: Active while it is collecting events, Finished once you complete it, and Discarded if you throw it away.

Step 2: Tune

The build form opens for the chosen capture, without the read point and capture selectors. Check the name, tick what should flag a tag and pick how different a read must be; the settings are described under Building a Signature. The Checked against its own capture panel beside the form shows the effect of each change as you make it. Next carries the tuning forward without saving anything, and Back returns to the capture choice. Coming back to this step keeps what you tuned, unless you pick a different capture.

Step 3: Build and Use

Review the capture, the name, the tolerance, the checks that will flag a tag, the minimum reads and the self-check result, then choose:

Button	What happens
Build and turn on matching	Builds the signature and compares every scan event at the read point with it from now on
Build only	Builds the signature and leaves it ready but not in use; the read point shows Matching off, and you can use the signature from its history grid later
Back	Returns to Tune

Both builds end with links to the read point and to the signature.

Building a Signature

The build form is the Tune step of the set-up wizard, where it saves nothing. It is also its own page at /read-signatures/build, reached with Build from this on an older capture in a read point's history, or Build another from this capture on a signature. There is no edit page for signatures: to change one, build a new signature from the capture.

The form is a short list of plain choices. A Checked against its own capture panel beside it shows the effect of each choice straight away.

1. Confirm the Read point and the finished Capture. They are fixed when you arrive from a capture; otherwise you pick them here (the address can also preselect them with ?group=, ?device= and ?capture=).
2. Check the Signature name. Tagnet prefills it as "{read point} normal, {date}", and a name you type is kept.
3. Under Flag a tag when it, tick the checks that should count as an unusual read.
4. Under How different before it counts, choose Tight, Balanced or Loose.
5. Watch the self-check panel, then click Build and turn on matching or Build only.

More settings is collapsed by default and holds the Description, the Transit window (RSSI drop) and Min reads to check. Most read points never need them.

The transit window decides which reads the movement checks look at: only those within this many dB of a tag's strongest read, which leaves out lingering before and after the pass. The default is 6 dB. If a pass has few reads near its peak, for example when the signal rises and falls sharply, widen it and watch the self-check: the panel rescores the capture at the new window as you move the slider. A capture finished before captures kept their raw reads stays at 6 dB.

Flag a Tag When It

Each tick is a check on one value of a tag's pass through the read point. A tag is judged by its worst ticked check: it does not match when any one ticked check is outside the accepted range. Ticking more checks can therefore only add mismatches, never remove them. Start with the defaults and add checks only after reviewing which tags the signature reports as unusual.

On by default:

Check	What It Catches
Reads unusually strong or weak	Peak signal strength. Tags far off the read point, or right against an antenna.
Lingers in the field, or passes too fast	Time in the field. A pallet parked next to the read point, or an unusually brief visit.
Does not move like a pass-through	Movement, from the phase the reader reports. Tags that sit still when they should travel, or the reverse.

The movement check needs the reader to report phase. The line under the checkbox says whether the readers at this read point do. A reader that reports periodic summaries instead of individual reads has no phase data, so this check has nothing to compare (see Scan Events for how phase stationarity works).

Off by default:

Check	What It Catches
Is read far more or less often than usual	Read rate. Weak or far-away tags. It depends on the reader's report filter, which the line under the checkbox names for the readers here, so tick it only when you need it.
Signal strength varies a lot while in the field	Tags at the edge of the read zone.

Click Show curve and phase extras (4 more) for four checks that look at the shape of the signal over a pass. They suit portals and gates, and are off by default:

Check	What It Catches
Phase varies unusually	A second movement check. Usually redundant with the movement check above.
Hesitates or reverses	Pacing or hesitation near the read zone.
Signal peaks at an unusual moment	The signal peaks early or late in the pass.
Approach and departure are lopsided	A tag that enters but never leaves, or the reverse.

Tick at least one check to build a signature.

How Different Before It Counts

The tolerance sets how far a tag's value may stray from the capture before the tag does not match. It is measured in standard deviations, a measure of how much the captured passes varied among themselves.

Level	Standard deviations	Description
Tight	1.5	Smaller strays count as unusual. For high-value, low-volume read points.
Balanced	2	Clear strays count as unusual. The default; most normal traffic matches.
Loose	2.5	Only clear outliers are flagged.

Checked Against Its Own Capture

The panel beside the form scores the capture against the signature you are about to build, and rescores it every time you change a tick or the tolerance. Nothing is saved while you adjust. It shows:

• A percentage of the capture's tag reads that would be flagged. It is green under 5%, amber from 5% to 15%, and red above 15%. Signatures can no longer be built from fewer than 10 passes; a signature built from fewer before that has no colour here and is described as too small to judge.
• "N of K captured tag reads would be flagged", and how many more had too few reads to be checked.
• A verdict in one sentence.
• Which checks did the flagging, as a count of tags per check.

The capture was normal traffic, so a good signature flags very little of it. Aim for under 5%. If the number is high, loosen the tolerance, untick the check doing most of the flagging, or capture again with more consistent passes.

Build Buttons

Both buttons build the signature from the capture.

Button	What happens
Build and turn on matching	Builds the signature, then the read point compares its reads with it
Build only	Builds the signature and returns to the read point, which has matching off. Use the signature from the read point later

In the set-up wizard these buttons are on the last step, Build and use. On the build page you return to the read point, or to the signature if you came from Build another from this capture.

Event-Level Reference Values

A signature also records the captured mean and spread of five event-level values: duration, tag count, read count, read rate, and RSSI. They are shown on the signature page and compared on each compared event's page for context, but they never decide whether an event or a tag matches. Only the ticked checks do.

Reading a Signature

Open a signature from its read point (View signature) or from the signatures grid under Captures and signatures here. Its page, at /read-signatures/{id}, answers three questions: where is this signature used, how is it doing this week, and what does it consider a normal read.

Header and Actions

The header shows the signature name and a line such as "Captured at Dock Door 3 on Oct 2 from 31 passes · Zebra FX9600 x2": where and when the capture was made, how many passes it holds, and the reader models involved.

Administrators have these actions in the Actions menu:

Action	Description
Apply to read points	Turn on matching at other read points (see Apply to Read Points)
Build another from this capture	Open the build form with the same capture. Building (or cancelling) returns you here
Stop using at {read point}	One entry for each read point using the signature
Browse all signatures	Every signature you can see
Delete	Delete the signature; matching turns off at every read point using it

Other users see Back to Read Signatures.

Status

The status card shows the read points using the signature and four tiles for the last 7 days.

• Used at: a chip for each read point using the signature, each linking to its workspace. The read point the signature was captured at is marked Captured here. If none uses it, the card says Not used anywhere.
• Captured under: one line per reader, summarizing the settings it had when the capture finished, for example "S2 / Target A / 10 s per antenna / 27 dBm / phase on". A signature built before Tagnet recorded reader settings shows Not recorded and keeps being compared as before, without change detection. See What a Signature Was Captured Under.
• Settings changed: when a reader at any read point using the signature no longer has settings it was captured under, a warning alert headed Settings changed on {reader} (or on N readers) lists each reader, the read point it is at, and what differs.
• Events compared, 7 days: events compared with this signature.
• Matched: the percentage of compared events that matched.
• Mismatches: events with a Partial match or No match outcome. Review opens the Scan Events list filtered to this signature's mismatches.
• Last mismatch: when the most recent mismatch happened.

What a Normal Read Looks Like Here

This section shows one row per check the signature uses. Each row has a plain sentence for the accepted range, for example "Most passes peak between -62 and -46 dBm", and a range chart.

On the chart:

• The green band is the accepted range at the signature's tolerance. A value outside it does not match.
• Grey dots are the passes in the capture.
• Red diamonds are this week's tags that this check flagged. Hover over one for its EPC, value and time.
• A flagged this week count sits at the end of the row.

If the capture's passes are no longer stored, only the green band is drawn.

A footer line gives the tolerance, the minimum reads a tag needs to be checked, and the result of the self-check stored when the signature was built, for example "Checked against its own capture: 1.6% of its captured tag reads would be flagged". Signatures built before the self-check existed have no self-check result.

Raw Statistics and Settings

This section is hidden until you click Show. It holds the numbers behind the charts:

• Tag metrics: the mean and spread of each check's value in the capture, and whether the signature checks it.
• Event metrics: the reference-only values described under Event-Level Reference Values.
• Settings: the tolerance (signatures built before the three levels existed show Custom), minimum reads to check, transit window, source capture, when it was built, and its scope.

Apply to Read Points

Apply to read points is how you share one signature across read points with the same reader setup. The dialog lists every read point you can see except those already using the signature. Each row shows:

• The read point and its kind (Device group or Reader)
• Its matching now: Matching off, or Matching with {signature}; would switch
• A compatibility note comparing the read point's readers with the settings the signature was captured under:
  • "Readers have the settings it was captured under."
  • "Settings differ, so these reads would not be compared: ..." followed by each reader and what differs. This note appears in a warning colour.
  • "Built before reader settings were recorded, so whether the readers match is not known."
  • "No reader here has stored settings, so whether they match is not known." A reader Tagnet holds no configuration for (one never deployed, for example) cannot be compared.

A "Settings differ" note is a warning, not a block. You can still apply the signature, but the readers named in the note are not compared until their settings match one the signature was captured under (see What a Signature Was Captured Under).

Tick the read points you want and click Apply. Each ticked read point turns on matching with this signature, replacing the signature it used before. A snackbar confirms, for example "Matching is on at 2 read points with 'Dock normal'." A read point can also pick a signature up from its own workspace with Use a signature from another read point; that list is the same idea from the other side.

Managing Signatures

Matching with a Signature

When matching is on, the workspace's Signature matching section names the signature in the Signature in use field (linked to its page) and says whether it was Captured here or Shared from another read point. Four tiles summarize the last 7 days:

Tile	Meaning
Compared, 7 days	Events compared with the signature
Matched	The percentage of compared events that matched
Mismatches	Events with a Partial match or No match outcome, with a Review link
Last mismatch	When the most recent mismatch happened

Under the tiles, a link opens the Scan Events list filtered to this read point.

Action	Description
View signature	Open the signature's own page
Recapture	Open the set-up wizard to capture again at this read point
Turn off matching	Stop comparing this read point's events with the signature

The signature's own page is described under Reading a Signature. It has no In use or Not in use chip, because a signature can be in use at some read points and not others. To stop one read point using it, choose Stop using at {read point} from the page's Actions menu. To turn on matching at other read points, choose Apply to read points from the same menu, or pick the signature up from a read point's own workspace.

A read point uses at most one signature at a time. Using a different signature replaces the current one.

Captures and Signatures Here

The collapsible Captures and signatures here section keeps the history for the read point. It has two grids.

The signatures grid lists the signatures captured at this read point:

Column	Description
Status	In use here, In use at N other read point(s), or Not in use
Name	Signature name
Capture events	Number of events in the capture it was built from
Built	When the signature was built
Actions	Details, Use this signature, Turn off matching, and Delete

Action	Description
Details	Open the signature's own page
Use this signature	Turn on matching at this read point with the signature (replaces whichever signature the read point was using)
Turn off matching	Stop comparing this read point's events with the signature
Delete	Remove the signature permanently (administrators)

The captures grid lists each capture with its name, status, event count, and start and end times. Its action menu offers Build from this on a finished capture, so you can build another signature from an older capture with different settings, and Delete on any capture that is not running. Deleting a capture keeps its scan events (they are simply no longer tied to the capture) and keeps any signature built from it; a running capture is discarded from the Capturing panel first. Deleting the captures and signatures at a read point returns it to Not set up.

Using a Signature Captured Elsewhere

If a read point has the same reader setup as another, it does not need its own capture. On a read point that is not set up, click Use a signature from another read point. Otherwise, expand the Use a signature from another read point section in the workspace. The grid lists signatures captured at other read points, each with Captured at, Used by, and Matched, 7 days. Each row carries the same compatibility note as the Apply to read points dialog, saying whether this read point's readers have the settings the signature was captured under. Click Use here on the one you want. Matching is now on at the read point with the other read point's signature, and the signature's Used by list grows by one.

This suits sites with identical hardware and reader settings, such as a chain of receiving docks. Capture again if the note says the settings differ, because transmit power, antennas, and report filter change what normal reads look like, and Tagnet does not compare the reads of a reader whose settings differ (see What a Signature Was Captured Under).

What a Signature Was Captured Under

The same tag reads very differently under different reader settings. A lower transmit power, a different Gen2 session, or a longer report filter changes read counts, signal strength and dwell time, so a signature built under one setup no longer describes normal reads under another. Tagnet therefore records the settings and notices when they change.

When a capture finishes, Tagnet records the settings of each fixed reader at the read point that change what reads look like. The signature built from the capture copies them.

• Zebra FX: mode, antennas, transmit power, cable loss, Gen2 session, target, select, tag population, environment, report filter, the RSSI floor (RSSI filter), and whether RSSI and phase are reported.
• Impinj R700: antennas, transmit power, session, search mode, RF mode, tag population, receive sensitivity and reporting interval, plus any other preset setting. Antenna names are ignored.

Identity, naming, heartbeat and batching settings are not recorded, because they do not change what a pass looks like. The signature page shows the result under Captured under (see Status).

If a reader's current settings match none of the settings the signature was captured under, Tagnet stops comparing that reader's events with the signature:

• In the Scan Events list, those events show a Settings changed chip in the Signature match column. Hover over it to read "Not compared: a reader's settings changed since the signature in use was captured." The event page shows a warning with the same explanation.
• The read point's status reads Settings changed, and the next action for administrators becomes Capture again.
• A warning alert headed Settings changed on {reader} (or on N readers) lists each reader and what differs, for example "Session S2 → S0". It appears in the read point workspace's Signature matching section, on the Read signature card of device and group pages, and on the signature page.

Only the reader that changed is affected. Other readers at the read point keep being compared.

A signature shared between read points holds for any reader whose settings match any reader it was captured on. This is what lets one signature serve sites with identical hardware, and Tagnet flags only the reader that drifted.

Two cases are never treated as changed. A signature built before Tagnet recorded reader settings keeps being compared without change detection. A reader with no stored settings is never treated as changed either.

To clear the warning, do one of these:

1. Capture again. A fresh capture records the new settings and builds a new signature for them. Use this when the new settings are intended, for example after you changed the report filter to suit the dock.
2. Change the reader's settings back to what the signature was captured under. Matching resumes for that reader.

Tip: Events that are not compared are not mismatches. A quiet mismatch count after a settings change may mean matching has paused for that reader, not that reads are normal.

Deleting

Deleting a signature turns off matching at every read point using it. The confirmation tells you how many read points that is. Deleting a device group also deletes the signatures captured at it, and matching turns off at any other read point using one of those signatures. Deleting a reader does the same for signatures captured at it as its own read point.

Reader Group Changes

A reader joining or leaving a group changes its read point. Signatures keep the read point they were captured under, and events a reader produced while it was grouped belong to the group's read point. After you move a reader into or out of a group, check which signature is in use at its new read point.

How Matching Works

Each tag in an event is compared with the captured range for every check ticked on the signature. A tag gets one of three match statuses:

Match status	Meaning
Matches	Every ticked check is within the tolerance
Does not match	At least one ticked check is further from the capture than the tolerance allows. In this guide, this is an unusual read.
Too few reads	The tag had fewer reads than the signature's Min reads to check, so it was not checked. It does not count against the event.

The tag's mismatch score is a number showing how far its worst ticked check strayed. Larger means more unusual.

The event then gets one of these outcomes:

Outcome	Meaning
Matches	Every checked tag matches
Partial match	Some tags match and some do not
No match	No checked tag matches
No tags	The event had no tags to check
Not compared	The event was not compared with a signature (none is in use for the read point, it arrived before you began using one, or a reader's settings changed since the signature was captured, shown as a Settings changed chip)

You can act on these results in workflows with the Match status and Mismatch score tag conditions. See Workflows.

Reviewing Mismatches

Mismatches are reviewed in the Scan Events list. When a signature in use finds unusual reads, the Last 7 days column of the Read Signatures list shows the count and the row's action becomes Review N mismatches. That button opens /scan-events filtered to the read point and to the Partial match and No match outcomes. The Review link on the workspace's Mismatches tile does the same. The Review link on a signature's own Mismatches tile opens the list filtered to events compared with that signature, shown as a Compared with: {signature} filter chip. Remove the chip to widen the list again.

Open an event to see which tags did not match and which signature the event was compared with. See Scan Events for the columns and filters of that list.

Read Signature Card on Device Pages

A reader's detail page and a device group's detail page each show a Read signature card. It uses the same status words and the same next action as the list. For example, a read point that is capturing shows Capturing with a progress bar and Finish capture, and one with matching on shows "Matching on. Signature in use: {signature}" (the name links to the signature), a few 7-day tiles (Compared, 7 days, Matched, Last mismatch), and Review N mismatches when there are mismatches. When a reader's settings no longer match the signature, the card shows Settings changed and the warning alert headed Settings changed on {reader}, with Capture again as the next action for administrators (see What a Signature Was Captured Under). The card replaces the old Signatures for this reader link. A reader that is in a group shows a note that its read point is the group, and the card reflects the group's state.

Best Practices

• Capture during normal operations: Record passes that represent what you expect. Unusual conditions during the capture will skew the signature.
• Collect enough data: Aim for 20 to 30 representative scan events. A bigger capture produces a more reliable signature.
• Start with Balanced: 2 standard deviations works well for most scenarios. Adjust after reviewing the self-check and the first results.
• Untick checks that do not apply: If your readers do not report phase, untick Does not move like a pass-through. The line under the checkbox tells you whether the readers here do.
• Capture again after changing reader settings: Transmit power, antennas, Gen2 session, and report filter all change what a signature was built from. Tagnet detects the change and stops comparing that reader's reads until you capture again or change the settings back, so watch for Settings changed rather than waiting for odd results. See What a Signature Was Captured Under.
• Try variations: Build several signatures from the same capture with different ticks and tolerances (Build another from this capture), then use the one whose self-check and results fit best.
• Aim for under 5% on the self-check: A signature that flags more than 5% of its own capture will flag normal traffic in production. Loosen the tolerance, untick the check doing most of the flagging, or capture again with more consistent passes.
• Review mismatches regularly: The signature is only useful if you learn which unusual reads are genuine problems and which are acceptable variation.