Search and view the different locations for which the alert was generated

Viewing Additional Details for Investigation 6-73 6.15.7.10 Navigate to other details pages for groups, users, devices, locations, sessions and fingerprints You can open details pages from other details pages: ■ From the Users tab: click the User Name link to open the User Details page. ■ From the Groups tab: click the Group Name link to open the Group Details page. ■ From the Locations tab, click the Location link to open the Location Details page. ■ From the Devices tab: click the Device ID link to open the Device Details page. ■ From the Fingerprint tab: click the Fingerprint ID to open the corresponding Fingerprint Details page. ■ Links for User Name, IP address, session, and location are available on the Sessions tab.

6.16 Uses Cases

This section describes example use cases for the Session Details page.

6.16.1 Use Case: Search Sessions

You are a member of the security team at Acme Corp. You work with Oracle Adaptive Access Manager on a regular basis, following up on escalated customer issues and security alerts. You perform a session search every couple hours throughout the day to identify any issues needing your attention and it is time to perform the next search. Directions: Search for sessions in the last 24 hours that have triggered high severity alerts and where access was blocked or locked. To search sessions: 1. Log in to OAAM Admin as an Investigator.

2. In the Navigation tree, double-click Sessions.

The Sessions Search page is displayed. 3. Search through sessions in the last 24 hours with high alerts and a blocked or locked authentication status

a. For Authentication Status, select Blocked and Locked.

b. For Login Time, select the date and time, 24 hours ago, and the current date

and time.

c. For Alert Level, select High.

d. Click Search.

6.16.2 Use Case: Session Details Page

You see a session with a Blocked authentication status. This may be a case of stolen authentication credentials so you want to look into it. You open the details page for this session to take a closer look at exactly what went on in this session. You see that the login had triggered a block. Phillip, the user, was dynamically added to a high risk users group because of this rule. Directions: Part A: Drill in on the policy that caused the block to see what rules triggered. Part B: You also want to see if this user has any CSR cases related to this lockout. Search the CSR cases and determine if Phillip called in for a temporary allow. To view session details: 6-74 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

1. In the Sessions Search page, view the Search Results table.

You noticed that for Phillip, one of his sessions shows: ■ a High alert in the Alerts column. Clicking the information icon, you see a velocity alert. ■ a Blocked status in the Authentication Status column. 2. Click the Session ID in the Search Results table to open the Session Details page. In Session Details panel, the Authentication Status shows Blocked. 3. View the final outcomes of each checkpoint. a. Expand the checkpoints. b. View the post-authentication checkpoints. c. Expand the post-authentication policies. d. Click the policy of interest to show details about the policy. e. View the rules that are triggered. f. View the final outcomes of the rules. There are two final outcomes: the user is blocked and been added to a high risk group. 4. Because you want to see if Phillip has any CSR cases related to this lockout, search the CSR cases and determine if he called in to have his challenge questions reset.

a. In the Navigation tree, double-click Cases. The Cases Search page is

displayed.

b. In Case Type, select CSR.

c. Enter Phillips user name into User Name field.

d. In Search Results table, look for Temporary Allow in the Last Action Type

column.

e. Click the Case ID for the case that has Temporary Allow in the Last Action

Type column.

f. In the Log subtab of the Case Details page, view notes.

The notes said he was traveling overseas when his wife asked him to look at their account online.

6.16.3 Use Case: Checking for Fraudulent Devices and Adding Them to a Group

Before You Begin Login with user who has an Investigator or Investigation Manager role. Checking for Fraudulent Devices and Adding Them to a Group 1. Search by action and alert to see recent blocked sessions. For example, search for sessions that have been blocked in the last two hours. You should see blocked sessions and the user who was blocked because of a device. For example, you see a user jsmith who was blocked because he was logging in using device 123 that had been blocked more than three times in the last 24 hours.