Click the Add to Group button in the upper right corner.

Viewing Additional Details for Investigation 6-9 Figure 6–3 Create a New Group to Add Sessions Parameter to Enter the following information to create a group: When adding a group to an existing group, data from selected rows of the type the group can accept are added to the group. If any data is already in the group, an informational message is displayed. When creating a group to add the entity to, do not leave any fields blank; otherwise, an error occurs.

4. Select Open this groups detail tab when done.

5. Click Add.

A confirmation dialog appears.

6. Click OK to dismiss the confirmation dialog.

6.7 Session Details Page

The Session Details page consolidates information needed for fraud analysis. To go to the Session Details page:

1. In the Search Results table, click the Session ID of the session of interest. The

Session Details page for that session is displayed. Table 6–5 Add to Group Fields Field Description Group Name The name of the group. Cache Policy Groups offer two Cache Policy options: Full Cache or None. By default, the Cache Policy should be set to all. For information, refer to Cache Policy . Group Type The type of group. Description Information about the group. 6-10 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager General details and all of the actions performed during the session are captured in the Session Details page. 2. View the details of the session.

6.8 Looking at Events from a Higher Level with Session Details

A Session Details page displays an overview of the events that transpired during a particular session for fraud analysis. It contains: ■ General session data points such as user, device, location, and other details ■ A forensic record of the session, including transactions and checkpoints that were evaluated. Each checkpoint displays the policies in that checkpoint, alerts that were triggered during the session for that checkpoint, and the final action for that checkpoint. The policy explorer view is also available to provide additional details about policies, rules, and conditions.

6.8.1 Policy Explorer

The Policy Explorer displays information about rules, conditions, trigger combinations, group linking, nested policies, and other items. Figure 6–4 Policy Explorer Rule Details Details about the rule is shown in the Policy Explorer. The session results display the scores and results of that rule. Viewing Additional Details for Investigation 6-11 Pre-conditions Pre-conditions for that rule is displayed in the details panel. The session results show the confidence factors and other values for the pre-conditions for that session. Conditions The values for the condition parameters are displayed. The session results show if the conditions returned true for this session evaluation. Trigger Combinations There is an option to view the triggered override combinations or view all overrides. Session results show the override information that was evaluated for this session including the nested policy information. Group Linking Group linking for the policy is displayed in the details panel.

6.8.2 Runtime Information

The Session Details page contains several panels. The main panels like checkpoints and transactions have multiple subpanels. Panel are not displayed if information is not available. Except for the Session Details panel, all other panels are displayed in the order of execution. Looking at the Session Details page, you can see the flow of events, the sequence when the events happened within the session. Figure 6–5 Session Details with Checkpoint, Alerts, Actions, and Policies

6.8.2.1 Session Details

The Session Details panel shows all the related information regarding the login transaction. It shows the authentication status, IP address from which the user logged in, user name, User ID, cookie information, autolearning processing status, and the login time.