On the Case Details page, click the Linked Sessions tab. Click the Link Sessions icon.

5-18 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager Figure 5–4 Add Notes About Linking 5. In the Notes field, select a note from the Note list or enter a note between 1 and 4000 characters into the text box to describe why you are linking the sessions. 6. Click Finish. The sessions are linked to the case and appear in the Linked Sessions tab.

5.7.2 Export Linked Session for Further Analysis

The Investigator can select one or more linked sessions and export them as MS-Excel document XLS for further analysis. Only MS-Excel document export is available. The maximum number of linked session you are allowed to export is pre-configured for 1000. If you want to change the limit, you must edit the following configurable property: oaam.xls.case.linkedsession.export.row.upperbound=1000 To export linked sessions for further investigation and analysis:

1. In the Case Details page, click the Linked Sessions tab.

The Linked Sessions page opens, listing all the linked sessions.

2. Select the linked sessions you want and click Export.

Investigation Using Agent Cases 5-19 3. Select Save Export File, browse for the location for file to be saved and click Export. The sessions are exported with the following details: ■ Row ■ Date and time the session was linked ■ Session ID ■ User Name ■ Device ID ■ Device score ■ Location ■ Alerts ■ Session date ■ Notes

5.7.3 Unlinking Linked Sessions

If they feel that the linked sessions are not relevant to the case, an Investigator can unlink them from the case. To unlink linked sessions: 1. On the Case Details page, click the Linked Sessions tab. 2. Click the Unlink Sessions icon. The Unlink Sessions dialog opens, listing all the selected sessions to be unlinked. 3. Search for and select the linked sessions to unlink and press Next. A dialog appears showing that the sessions have been unlinked from the case. 4. Enter notes about why you are unlinking the session. 5. Click Finish. The sessions are unlinked from the case.

5.8 Agent Case Feedback

Agent case feed back closed findings into the risk engine to improve accuracy of future evaluations automatically. For example, an investigator creates an Agent case and links several fraudulent sessions to it. Later, the investigator closes the case with a disposition of confirmed fraud. A predictive model is rebuilt every n hours to take into account data from sessions linked to cases with a confirmed fraud disposition. Investigators can determine the frequency of rebuilding the models. Each session in the system is compared to see how close it is to the fraudulent ones. The closer the match the higher the risk. An example evaluation would be, was the probability more than 50 that this login session is fraudulent based on all sessions linked to confirmed fraud cases?