From the results, select the sessions to link to this case and click Next.

Investigation Using Agent Cases 5-19 3. Select Save Export File, browse for the location for file to be saved and click Export. The sessions are exported with the following details: ■ Row ■ Date and time the session was linked ■ Session ID ■ User Name ■ Device ID ■ Device score ■ Location ■ Alerts ■ Session date ■ Notes

5.7.3 Unlinking Linked Sessions

If they feel that the linked sessions are not relevant to the case, an Investigator can unlink them from the case. To unlink linked sessions: 1. On the Case Details page, click the Linked Sessions tab. 2. Click the Unlink Sessions icon. The Unlink Sessions dialog opens, listing all the selected sessions to be unlinked. 3. Search for and select the linked sessions to unlink and press Next. A dialog appears showing that the sessions have been unlinked from the case. 4. Enter notes about why you are unlinking the session. 5. Click Finish. The sessions are unlinked from the case.

5.8 Agent Case Feedback

Agent case feed back closed findings into the risk engine to improve accuracy of future evaluations automatically. For example, an investigator creates an Agent case and links several fraudulent sessions to it. Later, the investigator closes the case with a disposition of confirmed fraud. A predictive model is rebuilt every n hours to take into account data from sessions linked to cases with a confirmed fraud disposition. Investigators can determine the frequency of rebuilding the models. Each session in the system is compared to see how close it is to the fraudulent ones. The closer the match the higher the risk. An example evaluation would be, was the probability more than 50 that this login session is fraudulent based on all sessions linked to confirmed fraud cases? 5-20 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

5.9 Configuring Agent Case Access

By default only Investigators and Investigation Managers have access to create Agent cases. The property for investigator access is oaam.permission.creatagentcase=oaam.perm.create.case.type.agent To give a CSR access to Agent cases, configure the property as follows: oaam.permission.creatagentcase=oaam.perm.create.case.type.csr After setting the property, the CSR should have full access to create agent cases.

5.10 Configuring ExpiryOverdue Behavior for Agent Cases

The expiryoverdue behavior can be configured using the Properties Editor. Agent Cases have a default expiration date of 24 hours from the date of creation. Information to change the default behavior is provided below.

5.10.1 Set Overdue Behavior for Agent Cases Default Setting

To set expiryoverdue behavior for Agent cases, modify the following properties as shown below. customercare.case.expirybehavior.enum.agentcase.behavior = overdue customercare.case.expirybehavior.enum.agentcase.label = Overdue customercare.case.expirybehavior.enum.agentcase.durationInHrs = 24 customercare.case.expirybehavior.enum.agentcase.resetonaccess = true

5.10.2 Disable OverdueExpiry Behavior for Agent Cases

To disable the overdueexpiry behavior for Agent cases, modify the following property as shown below. customercare.case.expirybehavior.enum.agentcase.behavior = none

5.10.3 Set Expiry Behavior for Agent Cases

To set expiry behavior for Agent cases, modify the following properties as shown below. customercare.case.expirybehavior.enum.agentcase.behavior = expiry customercare.case.expirybehavior.enum.agentcase.label = Expired customercare.case.expirybehavior.enum.agentcase.durationInHrs = 24 customercare.case.expirybehavior.enum.agentcase.resetonaccess = false

5.11 Agent Use Cases

Common agent use cases are listed below.

5.11.1 Agent Creation

Agent use cases are provided below. Groups for the examples are presented in the following chart. Note: You do not need to change the other parameters.