Policy Explorer Looking at Events from a Higher Level with Session Details

6-12 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

6.8.2.2 Policies

A list of policies in that checkpoint are displayed in the Policies panel. You can view the rules and action that triggered. As an investigator, you are interested in why a particular rule triggered. For example, you might look at which policy and rules triggered the alert. Information can be gathered by looking at these details. For example, a user who successfully went through Pre-Authentication and Post-Authentication checkpoints knew the password and the questions and answers and there fore, there is a good chance that he is a valid user. On the other hand, a user who attempted to answer the questions twice and succeeded in providing a correct answer on his third attempt might be considered suspicious. This user did not know the answers right away so there is a chance that he may be a fraud trying out new answers. To view more details about the policy, you can launch the Policy Explorer using the icon on top of the panel or from any of the icons within the table. The policy link displays the Policy Details page and the rules link displays the Rule Details page. Only active and triggered rules are displayed. Only active policies are displayed. You have the option to view all the rules in the Policy Explorer. In the Policy Explorer, you can view the runtime values for each one of the policies and rules that were triggered. For example, if a rule triggered that showed that the user had logged in from a country that he did not usually log in from, you would want to look at the runtime details to see which country he logged in from. The Policy Explorer shows the policies that were triggered, the condition parameters, and the actual values.

6.8.2.3 Transactions

The Transactions panel displays a list of transactions that were created. You can view the actual transaction data and the entity attribute values used in the transactions. For example, a fraud investigator analyzing a session can see that a user was blocked performing a transaction and that a particular rule was triggered, and he can also see the amount that was passed in and the account number that was used in the transaction. Transactions can be created within a checkpoint or without an associating checkpoint. If a Transaction ID is not provided as in the case of a transaction without an associating checkpoint, OAAM processes the last transaction in the session. The Table 6–6 Policies in a Checkpoint Item Description Name The name of the policies that are under the checkpoint, rules under the policies, the conditions under the rules, and the action triggered. Status Executed for policies and Triggered for rules. Scoring Engine A scoring engine is provided at the policy level and at the checkpoint level. The policy scoring engine is applied to rule scores to determine the risk for each policy. Time The time of the occurrence. Weight Percentage value used to influence the total score. Score Level of risk that has been calculated for specific situations or parts of a situation, expressed as a number. There are multiple policies under one checkpoint. The scores of these policies are used to determine a score for the checkpoint. Viewing Additional Details for Investigation 6-13 Transaction data for all transaction types are displayed in the Transactions panel of the session details page whether associated to a checkpoint or not. The Transaction checkpoints and policies are displayed in the order of execution along with other checkpoints, but the order of execution of the transactions and the checkpoints at which a particular transaction occurred cannot be determined.

6.8.3 Action, Alerts, and Scores

Table 6–6 shows an example of alerts, actions, and scores displayed in a Session Details page. Figure 6–6 Session Details: Alerts, Actions, and Scores Alerts The Alerts panel shows alerts that were generated for a checkpoint during the session and details about the alerts, as shown in the table below. Each checkpoint could trigger multiple alerts. High-level alerts are displayed in bold red. Table 6–7 Sessions Checkpoint Actions Item Description Level Severity of the alert whether high, medium, low. Alert Message Text message configured in the alert. Type Type of the alert whether fraud, investigation, information, or other reason Trigger Source Rules that generated the particular alert Timestamp The time the alert was generated.