In the Navigation tree, select Patterns. The Patterns Search page is displayed.

10-52 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

2. In the Navigation tree, select Policies. The Policies Search page is displayed.

3. For the Checkpoint filter, select Post-Authentication and click Search.

4. Look through the policy descriptions in the Search Results table for ones that do

not occur after the password has been entered and ones that do not use conditions based on challenges. The Fraud Cant Challenge seems to be one that fits the criteria. The description for Fraud Cant Challenge is Applied to users with no challenge questions active .

5. Open the Fraud Cant Challenge policy to view its rules.

The rules involve devices, IPs, locations as inputs and there are no actions to challenge the user. Therefore, the policy can be used in the pre-authentication checkpoint.

6. In the Policy Details page, click Copy Policy.

7. In the Copy Policy dialog, select Pre-Authentication as the checkpoint.

8. Enter a name and description for the policy.

9. Select Active or Disabled as the policy status.

If you want the policy to be enabled as soon as it is created, select Active for Policy Status . If you want to policy to be disabled, select Disabled. A policy that is disabled is not enforced at the checkpoint.

10. Click Copy.

A copy of the policy is added to the Pre-Authentication checkpoint.

10.34.13 Use Case: Conditions: IP: Login Surge

William is a Security Administrator and he must configure a policy and rule to track the number of logins from the same IP and if there are more than 10 logins in 1 hour from an IP, a high alert should be triggered. 1. Log in to OAAM Admin as an administrator.

2. Create a Monitor IP group

a. In the Navigation tree, double-click Groups.

b. In the Groups Search page, click the New Group button.

The Create Group screen appears. c. Enter the group name, Monitor IPs, and select IP as the Group type and click Create .

d. In the Monitor IPs group page, click the IP tab.

e. In the IP tab, click the Add button.

f. In the Add IPs screen, select the Search and select from the existing IPs

option, enter criteria, then click Search. g. From the Search Results table, select one of the IPs that you want to monitor and click Add. A confirmation dialog appears.