Best Practices and Recommendations

5-2 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager ■ A fraud investigator creates an Agent case when a suspicious activity or fraud scenario is detected and needs investigation. ■ A configurable action creates an Agent case automatically as a supplementary action that is triggered based on a result action andor risk score after a checkpoint execution. Agent cases are not created for specific users. They are created for specific scenarios. Events can be configured to create a case automatically. Agent type cases are used by fraud investigators to do the following: ■ Collect investigation findings for audit including which investigators have worked on a case ■ Manage the lifecycle of an investigation including severity, status, ownership changes, time to resolution, droppedlost cases and resolution ■ When closed findings are fed back into the risk engine to improve accuracy of future evaluations automatically ■ Export findings to Excel for external records or processes A fraud investigator can quickly view the data involved in an incident and quickly locate related situations by easily harnessing the complex data relationships captured by OAAM. Search and detail pages provide fraud investigators the ability to: ■ Drill into individual sessions to see the exact chain of events that led to an alert ■ View and search for complex relationships between different data types ■ Whiteblack list entities on the fly without leaving the investigation flow ■ Link session data to a case to further narrow the investigation

5.1.2 Case Status

Case Status is the current state of a case. Status values used for the case are New, Pending , Escalated, or Closed.

5.1.2.1 New and Pending Cases

Cases are New when they are created regardless of the method manualconfigurable action. When a new case is accessed for the first time, the status automatically changes to Pending. For example, if an Agent case is created by a configurable action, it contains the session data for which it was created and it has a New status. If an investigator searches for all Agent type cases with a New status, and he opens the case details page for one of the new cases, the case status automatically changes to Pending. This allows Investigators to know if someone is already working on a case. Table 5–1 Case Status Status Definition New The status of a case when it is created. Pending The status of a case that is not yet resolved. Closed The status of a case when the issue is resolved. Escalated The status of a case when a CSR escalates a case. Investigation Using Agent Cases 5-3

5.1.2.2 Closed Cases

Closed is the status of a case when the issue is resolved.

5.1.2.3 Escalated Cases

If a CSR case is escalated to an Agent case, the status changes to Escalated in the process. The first time an investigator accesses the case, the status changes to Pending automatically. The CSR escalates a case when he cannot resolve a case and needs further investigation by an investigator or when he determines there is suspicious activity associated with the specific user and he wants further investigation by an investigator. Once escalated the case is treated as an Agent case, which is no longer visible to the CSR. However, any agent can work on the escalated case.

5.2 Fraud Investigation Role Permission

Fraud Investigator and Fraud Investigation Manager are out-of-the-box roles provided by Oracle Adaptive Access Manager. A Fraud Investigator investigates a specific fraud scenario or suspicious pattern. In order to work on the scenario or pattern, he creates an Agent case. A Fraud Investigation Manager has access to actions that the Fraud Investigator does not have. They can reopen closed cases and bulk edit cases. To act upon the fraudulent sessions, they create Agent cases, and then link the fraudulent sessions to the case. Based on the type of fraud, they perform further case actions. The out-of-the-box permissions associated with fraud investigation are summarized in Table 5–2 . Additional actions are listed in Appendix A, Access Roles. Table 5–2 Fraud Investigation Role Permissions Action Investigator Permissions Investigation Manager Permissions Actions All functions of Investigator role All functions of Investigator role and some special privileges Search Cases ■ Search for CSR, Escalated and Agent cases ■ Search for open and closed cases ■ Search for CSR, Escalated and Agent cases ■ Search for open and closed cases. New Case Only Agent cases Only Agent cases View Case Details ■ View Escalated Case ■ View closed case details ■ View Escalated Case ■ View closed case details Edit Case ■ Add notes to CSR and Escalated Cases ■ Change status and severity ■ Cannot bulk edit cases ■ Escalate cases ■ Add notes to CSR and Escalated Cases ■ Reopen closed cases ■ Change status and severity ■ Bulk edit cases ■ Escalate cases Search session Search sessions Search sessions Link sessions Link sessions Link sessions Unlink sessions Unlink sessions Unlink sessions View linked sessions View linked sessions View linked sessions