Use Case: Device and Location Details

6-78 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

2. Click the Fingerprint Data tab.

3. In the Search Results table, check to see if Spanish is listed as the Locale for the Fingerprint.

6.16.11 Use Case: Adding Devices Used for Fraud from a Location To a Risky Group

An investigator is viewing a table of devices used from a location and decides two of them were used for fraud. He can select them and add them to a high risk devices group to be used in future risk evaluations. He should not lose the context of what he was doing in the process. 1. Open the OAAM Admin Console. 2. Search for sessions. 3. Open location details page. 4. Search for devices used from this location. 5. Select two devices and add them to a high risk group.

6.16.12 Use Case: Adding Suspicious Device to High Risk Device Group

George is a user who gets blocked because he was logging in using a device that had been blocked more than three times in the last 24 hours. Jeff, an investigator wants to compare the blocked device with other devices this user has used in the past. He opens the fingerprint details for the blocked device and for another device the user has used many times successfully. From the user interface Jeff can see that the blocked device was a Linux machine with Opera running in Russian locale. The device the user seems to use most of the time is a Windows XP machine with IE running in English locale. As a result Jeff adds the blocked device to a high risk devices group, and adds the IPs used by the device to a high risk IPs group directly from the search screen. 1. Open the OAAM Admin Console. 2. Search for sessions. 3. Open 2 device details pages. 4. View the full list of fingerprint data for both devices. 5. Select device and add it to a high risk group. 6. Select IP and add it to a high risk group.

6.16.13 Use Case: Mark Devices and IPs as High Risk

An investigator is searching for sessions with high alerts in the last hour. Out of the 30 sessions he thinks two were fraud so he wants to mark the devices and IPs used as high risk. 1. Open the OAAM Admin Console. 2. Search for sessions with high alerts in the last hour. 3. Select the two sessions and click the add to group button. A dialog appears asking what data types from these sessions to add. 4. Select devices and IPs. Message appears which asks the user to select a device group and an IPs group. 5. Select and add the high risk devices and high risk IPs. Viewing Additional Details for Investigation 6-79 A confirmation appears with message that the devices were added and that one IP was added and the other was already in the high risk IPs group.

6.16.14 Use Case: Search for Suspicious Sessions and Add Devices to High Risk Group

Before You Begin Login with user who has a Fraud Investigator or Fraud Investigation Manager role. Search for Suspicious Sessions and Add Devices to High Risk Group Garry is an investigator searching sessions looking for suspicious situations not found by the currently configured rules. He filters for all sessions in the last month with block actions from Mexico because of a recent incident. He selects all other sessions and in a single operation adds all the devices to a high risk device group. 1. Open the OAAM Admin Console. 2. Search sessions. 3. Add to group from search page.

6.16.15 Use Case: Search Sessions by Alert Message

An investigator is searching for sessions with high alerts with a message containing speed. The search returns 20 sessions containing high alerts with the following messages: Excessive speed navigation and User air speed. 1. Open the OAAM Admin Console. 2. Search for sessions with high level alerts and messages containing speed.

6.16.16 Use Case: Search Sessions by Geography

An investigator is searching for sessions with an ID number that starts with 40 from Los Angeles, CA, USA in the last two hours. 1. Open the OAAM Admin Console. 2. Search for sessions with an ID number starting with 40 from Los Angeles in the last two hours.

6.16.17 Use Case: Search by Comma Separated Values

Jeff wants to see what activity has occurred recently from a list of high risk IPs he pulled from a portal. To gauge the value of the IP data he decides to view the activity from those IPs in the last six weeks and determine if any of the activity was suspicious. Jeff starts by searching sessions that have used this comma separated list of IPs and viewing the sessions that come back. 1. Open the OAAM Admin Console. 2. Search for sessions by pasting a comma separated list of IPs into the search field and filtering to the last two weeks. Only sessions from the IPs in the list are shown.