Double-click Sessions in the Navigation tree.

Viewing Additional Details for Investigation 6-79 A confirmation appears with message that the devices were added and that one IP was added and the other was already in the high risk IPs group.

6.16.14 Use Case: Search for Suspicious Sessions and Add Devices to High Risk Group

Before You Begin Login with user who has a Fraud Investigator or Fraud Investigation Manager role. Search for Suspicious Sessions and Add Devices to High Risk Group Garry is an investigator searching sessions looking for suspicious situations not found by the currently configured rules. He filters for all sessions in the last month with block actions from Mexico because of a recent incident. He selects all other sessions and in a single operation adds all the devices to a high risk device group. 1. Open the OAAM Admin Console. 2. Search sessions. 3. Add to group from search page.

6.16.15 Use Case: Search Sessions by Alert Message

An investigator is searching for sessions with high alerts with a message containing speed. The search returns 20 sessions containing high alerts with the following messages: Excessive speed navigation and User air speed. 1. Open the OAAM Admin Console. 2. Search for sessions with high level alerts and messages containing speed.

6.16.16 Use Case: Search Sessions by Geography

An investigator is searching for sessions with an ID number that starts with 40 from Los Angeles, CA, USA in the last two hours. 1. Open the OAAM Admin Console. 2. Search for sessions with an ID number starting with 40 from Los Angeles in the last two hours.

6.16.17 Use Case: Search by Comma Separated Values

Jeff wants to see what activity has occurred recently from a list of high risk IPs he pulled from a portal. To gauge the value of the IP data he decides to view the activity from those IPs in the last six weeks and determine if any of the activity was suspicious. Jeff starts by searching sessions that have used this comma separated list of IPs and viewing the sessions that come back. 1. Open the OAAM Admin Console. 2. Search for sessions by pasting a comma separated list of IPs into the search field and filtering to the last two weeks. Only sessions from the IPs in the list are shown.