Linked Sessions Oracle Fusion Middleware Online Documentation Library

5-10 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager The default description type is Custom Description. The Description text box can contain alphanumeric and special characters, but it should not exceed 4000 characters. You can select a description from the Description list, one at a time for any number of times. Each description selected from the list is appended to the previous. Description is a required field. The Create button is disabled until a description is entered.

5. Click Create.

The Create button is disabled until all the fields are entered. Required fields are marked with a asterisks. If invalid parameters were entered, an error message is displayed and the new case is not created. Click Cancel to cancel changes and return to the Cases Search page. Click Create to create a new case. The case is created and the Case Details page opens for the new case. For information, refer to Section 5.5.3.1.1, Case Details. The Case Details page shows Pending as the status of the case. The agent is listed in the Created by and Current Owner fields. There are no user details shown in the Case Details because the case is a user less Agent case. The new Agent case does not contain any linked sessions. When you view the logs, Create Case is displayed as the Action. Manual Agent Case Creation Example An Agent creates an Agent type case for the 1st Bank Organization ID. He is not given the option to create cases of other types CSR case. Organization ID is a required field. The new Agent case does not contain any linked sessions. He is not required to enter any user information to create the case since Agent cases are not linked to any single user.

5.5.6 Creating an Agent Case Automatically by a Configurable Action

To configure an action so that an Agent case is created automatically:

1. Create a custom rule action called create_agent_case.

2. Add a rule with the rule condition you want to a policy for the appropriate checkpoint. Configure it such a way that it triggers and returns the action create_ agent_case whenever the specified conditions are met. For example, whenever a suspicious activity occurs the create Agent case action is triggered.

3. Create an action instance of the action template CaseCreationAction and associate

it to the checkpoint.

4. Set the trigger criteria as the action by selecting create_agent_case action.

5. Set the parameters of CaseCreationAction as follows:

a. Enter 2 for Agent type as value of Case Type.

b. Enter 2 for Medium or 3 for High for the Severity.

c. Enter a case description. For example, Failed login. d. Enter the userId for Case Creator UserId parameter. Make sure that userId has a proper role and access permissions for creating the case. For our example, the Case Creator is Dynamic. 6. Save the action instance. 7. Log in to the application unsuccessfully. Investigation Using Agent Cases 5-11 On every unsuccessful log in, you should see an automatic creation of an Agent case by the configurable action. The status of the case is New. The new Agent case has auto linked sessions based on the action instance parameters. It will contain the session data for which it was created. There are two logs for the autocreated Agent case: one for creation and one for the link session. If an Investigator opens the case, the Status of the case changes to Pending. The Current Owner is the Investigator and the Created by displays the Case Creator UserId. User Details are also shown for this case. 8. Verify that the sessions that correspond to the action instance parameters like checkpoint, score range, execution type are autolinked to the Agent case that is created by the configurable action. Agent Case Autocreation Example 1. A Security Administrator configures an action to create agent cases when specific rules trigger. When this case creation action generates a case, the session data in which the rule triggered is added to the case in the form of a linked session. 2. Fraud Investigator opens the OAAM Admin Console and sees only the appropriate user interface views and controls afforded his role. 3. Fraud Investigator searches cases by new status 4. Fraud Investigator opens the case at which time he becomes the current owner and the status of the case changes to pending. 5. He can continue linking session to the case andor drill in on the data in the linked session using the details screens. 6. When finished, the Investigator closes the case with a disposition and notes.

5.5.7 Creating an Agent Case from an Escalation

To escalate a case so that Investigators can review it: Escalate CSR to Agent Case Example 1. CSR Manager escalates CSR case 2. A fraud investigator picks up the escalated type case and reads the notes entered by the CSR and CSR Manager. The status automatically changes from escalated to pending. 3. He searches for the session history of the user. 4. Investigator selects the session from the Ukraine and searches for related sessions and cases. He finds no sessions or cases that seem suspicious 5. He determines that he can safely add the user to the override group for this rule. 6. The investigator then closes the case with a resolved customer override disposition. 7. Every three months a security administrator removes all users from the override group.