In the menu bar, click More Actions, and then click Change Status.

4-42 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

2. In the Navigation tree, double-click Cases. The Cases Search page is displayed.

3. In the Expired field, select Show Only Expired.

4. In the Case Type field, select CSR.

5. Click Search

There are four cases with the Expired status. 6. View Created Date column for the four cases in the Search Results table. ■ All are more than two days old. View Created Date ■ One of them has a High severity and the last action was a temp allow. View Case Severity and Last Action Type columns. 7. Select the three cases and click Bulk Edit. 8. In the Status field, select Closed. 9. In Deposition field, select Issue Resolved. 10. In Notes, enter expired and resolved. 11. Click the Case ID for the High severity case. 12. In the Case Details page, view the log for log code and notes.

4.16.6 Use Case: CSR - Ask Questions

User customer is a registered user. He has not been challenged for the past 30 days and when he had to answer a challenge question, he completely forgot the answer to this question. He is sure he remembers the answers to his other questions. User answers the question incorrectly all 3 times. Before he could try it out, he is blocked. He calls customer support, and the CSR creates a case and asks challenge questions. She enters the users answers until he answers correctly or is locked out. He answers the question correctly. He is unlocked and is able to login successfully. The CSR informs the user he must register new questions online next time he logs in. The CSR closes the case.

4.17 Best Practices and Recommendations

This section provides best practices and recommendations: ■ A Fraud Investigator looks into suspicious situations either escalated from customer service or directly from OAAM Admin alerts. ■ A Fraud Investigation Manager determines which cases must be given attention by his team. ■ If a customer suspects fraud, then the severity level assigned is High. For example, if the customer wants a different image, then the severity level assigned is Low. Severity levels of a case can be escalated or deescalated when necessary. Anyone can change the severity of cases. 5 Investigation Using Agent Cases 5-1 5 Investigation Using Agent Cases Oracle Adaptive Access Manager allows the creation of Agent cases to make forensic investigations quicker, easier and more successful. Investigators can link relevant sessions that may be connected to fraud cases to locate relationships between data that is linked, sessions in which suspicious activity occurred, or sessions in which alerts were generated. Investigators can link suspicious sessions. They can also unlink sessions that they think are no longer suspicious. This chapter provides information to Investigators for using the new Agent cases. It contains the following sections: ■ Introduction and Concepts ■ Fraud Investigation Role Permission ■ Opening the Case Search Page ■ Searching for Cases ■ Viewing, Editing, and Creating Cases ■ Editing Agent Cases ■ Linking and Unlinking Suspected Sessions to a Case ■ Agent Case Feedback ■ Configuring Agent Case Access ■ Configuring ExpiryOverdue Behavior for Agent Cases ■ Agent Use Cases ■ Best Practices and Recommendations

5.1 Introduction and Concepts

This section provides an introduction to Investigators and a high-level view of how they might use the Oracle Adaptive Access Manager Agent cases to investigate fraudulent activity.

5.1.1 Agent Cases

An Agent case is a tool used for investigation. It can be created manually or automatically. ■ A CSR creates an Agent case when he escalates a case because further investigation from an Investigator is needed. Refer to Section 5.1.2.3, Escalated Cases.