Investigation Workflow for CSR Escalated Agent Cases

5-38 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager 5. Fraud Investigator repeats step 3 and 4 as required. 6. Fraud Investigator generates list view of users affected. 7. Fraud Investigator adds users to victim list. 8. Fraud Investigator adds device to black list. 9. Fraud Investigator closes case.

5.11.6 How Users Use Agent Cases for Investigation

Oracle Adaptive Access Manager allows the creation of Agent cases to make forensic investigations quicker, easier and more successful. An Agent case is created when a suspicious activity or fraud scenario is detected and needs investigation. An example of how an Investigator uses Agent cases is shown below. 1. The Investigator receives automated high alerts of the type, Fraud. 2. The Alert message notifies him that there are potentially suspicious sessions from North Carolina. 3. The Investigator immediately logs in to OAAM and searches sessions based on various filter criteria, such as the sessions from North Carolina. 4. He determines the sessions that needs investigation. 5. The Investigator creates an Agent case and start the investigation. 6. He selects these sessions and links them to the case. As part of the linking the Investigator enters notes describing why the sessions were linked. The case log records the notes as well as the user who performed the link action. These sessions stay linked to the case unless they are unlinked by an investigator or manager. 7. The Investigator looks at the city and state in the Location Details page because many of the suspicious sessions occur in North Carolina. 8. Once the Investigator comes up with a conclusion, he closes the case with a disposition.

5.11.7 Associating Fraud Sessions with a Case for Investigation

The following section outlines the steps to associate fraud sessions with a case for investigation. Before You Begin Ensure that you have the proper permissions to create and work with Agent cases. Associating the Fraud Sessions with a Case for Investigation You receive automated high alerts of the type, Fraud, and the alert message notifies you that there are potentially suspicious sessions. 1. Log in to the OAAM Admin Console and search for sessions based on various criteria. For example, you might search for all sessions that were blocked in the last 12 hours with High alerts sessions filtered by Time, Alert Level and Action. Investigation Using Agent Cases 5-39 2. Go to the Session Details page to collect more information about the session you are interested in. You could look at: ■ Outcomes of checkpoints ■ Policies and rules triggered As an investigator, you are interested in why a particular rule triggered. For example, you might look at which policy and rules triggered the alert. Information can be gathered by looking at these details. For example, a user who successfully went through Pre-Authentication and Post-Authentication checkpoints knew the password and the questions and answers and there fore, there is a good chance that he is a valid user. On the other hand, a user who attempted to answer the questions twice and succeeded in providing a correct answer on his third attempt might be considered suspicious. This user did not know the answers right away so there is a chance that he may be a fraud trying out new answers. 3. In the Policy Explorer in Session Details, view the runtime values for each one of the policies and rules that were triggered. For example, if a rule triggered that showed that the user had logged in from a country that he did not usually log in from, you would want to look at the runtime details to see which country he logged in from. The Policy Explorer shows the policies that were triggered, the condition parameters, and the actual values. 4. Determine the sessions you need to investigate. 5. Create an Agent case and start the investigation. 6. Search and select these sessions and link them to the case. As part of the linking enter notes describing why the sessions were linked. The case log records the notes as well as the user who performed the link action. These sessions stay linked to the case unless they are unlinked by an investigator or manager. 7. Identify the relationship between the sessions and view the appropriate detail pages. For example: If the suspicious sessions used the same device, view the Device Details page. If the suspicious sessions are from the same location, view the Location Details page. If the suspicious sessions are from the same user, view the User Details page. If the suspicious sessions all used a Spanish browser, view the Fingerprint Details page. a. View Location Details page. b. View Device Details page. c. View Fingerprint Details page. d. View Alert Details page. e. View User Details page. 8. Analyze the sessions and when you reach a conclusion, close the case with a disposition.