Click the New Pattern button.

10-52 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

2. In the Navigation tree, select Policies. The Policies Search page is displayed.

3. For the Checkpoint filter, select Post-Authentication and click Search.

4. Look through the policy descriptions in the Search Results table for ones that do

not occur after the password has been entered and ones that do not use conditions based on challenges. The Fraud Cant Challenge seems to be one that fits the criteria. The description for Fraud Cant Challenge is Applied to users with no challenge questions active .

5. Open the Fraud Cant Challenge policy to view its rules.

The rules involve devices, IPs, locations as inputs and there are no actions to challenge the user. Therefore, the policy can be used in the pre-authentication checkpoint.

6. In the Policy Details page, click Copy Policy.

7. In the Copy Policy dialog, select Pre-Authentication as the checkpoint.

8. Enter a name and description for the policy.

9. Select Active or Disabled as the policy status.

If you want the policy to be enabled as soon as it is created, select Active for Policy Status . If you want to policy to be disabled, select Disabled. A policy that is disabled is not enforced at the checkpoint.

10. Click Copy.

A copy of the policy is added to the Pre-Authentication checkpoint.

10.34.13 Use Case: Conditions: IP: Login Surge

William is a Security Administrator and he must configure a policy and rule to track the number of logins from the same IP and if there are more than 10 logins in 1 hour from an IP, a high alert should be triggered. 1. Log in to OAAM Admin as an administrator.

2. Create a Monitor IP group

a. In the Navigation tree, double-click Groups.

b. In the Groups Search page, click the New Group button.

The Create Group screen appears. c. Enter the group name, Monitor IPs, and select IP as the Group type and click Create .

d. In the Monitor IPs group page, click the IP tab.

e. In the IP tab, click the Add button.

f. In the Add IPs screen, select the Search and select from the existing IPs

option, enter criteria, then click Search. g. From the Search Results table, select one of the IPs that you want to monitor and click Add. A confirmation dialog appears. Managing Policies, Rules, and Conditions 10-53

h. Click OK.

i. Add IPs to monitor as needed.

3. Create an IP Surge High Alert group

1. In the Groups Search page, click the New Group button.

The Create Group screen appears. 2. Enter the group name, IP Surge, and select Alerts as the Group type and click Create . A confirmation message appears.

3. Click OK to dismiss the confirmation dialog.

The new IP Surge alert group is created successfully and the Group Details page is displayed.

4. Click the Alerts tab to add alerts to the group.

5. In the Alerts tab, click the Add Add Member button.

6. In the Add Member page, select Create new element.

7. For Alert Type, select Investigator.

8. For Alert Level, select High.

9. For Alert Message, enter More than 10 logins from the same IP in 1 hour.

10. Click Add to add the alert to the group.

A confirmation dialog appears.

11. Click OK to dismiss the dialog.

4. In the Navigation tree, double-click Policies.

5. In the Policies Search page, click the New Policy button.

The New Policy page appears. In the Summary tab, the default values for the new policy are displayed as follows: ■ Policy Status: Active ■ Checkpoint: Pre-Authentication ■ Scoring Engine: Average ■ Weight: 100 6. Create a new pre-authentication security policy.

a. For Policy Name, enter Logins_SameIP.

b. For Description, enter Track the number of logins from the same IP and if

there are more than 10 logins in the last hour from an IP .

c. Select Active as the policy status; otherwise the policy is not enforced at the

checkpoint.

d. Enter Weighted Maximum Score for the scoring engine and 100 as the weight.

e. Click Apply.

A confirmation dialog displays the status of the operation. If you click Apply and the required fields are not filled in an error message is displayed.