Auditing a decision path

Risk Analytics offers the Decision Path Audit tool to audit the execution of rules Rules are used to define sets of criteria to verify if an event (transaction and non-monetary event) matches any fraudulent behavior. If an event matches a previously defined rule, an alert can be raised., divisions Decision divisions group several types of rules in a hierarchical structure to filter the events to ensure that the raised alerts can be processed adequately., and campaigns Decision campaigns group elements in a hierarchical structure to filter events and ensure that the raised alerts can be processed adequately. Campaigns target specific record types such as for instance approved transactions only. A campaign is the top filtering level.. With this feature you can verify

• why an event has matched or not matched a rule
• why actions are triggered or not
• why the Data Collector web service is slower than expected
• why a rule takes longer than expected to execute.

Poor response times for event processing in the Data Collector web service can be investigated with this screen, as it details the duration of the decision hierarchy phase. It enables you to verify if time is consumed in the decision hierarchy processing in real-or near-time processing. It is possible to track which campaign, rule, or process triggered by a rule consumes time.

To audit a decision path

1. Navigate to DESIGN RULES & ACTIONS > Decision Path Audit.

2. Select the item to be audited from the Rule Management list menu displayed in the Decision Path Audit dashboard.

3. In the Rule Management Key field, enter the ID of the event to audit (TXN_ID or NON_MON_EVENT_ID).

4. Click Get Decision Path to display any matches and the decision path.

Sections of the Decision Path Audit screen

Once you click Get Decision Path, the Decision Path Audit screen will provide information (such as the time required for the audited event to be processed) in the Matches and Decision Path sections of the screen.

Matches section

The first table lists the names of all rules which the relevant event has matched. This list is ordered by division and rule priorities as defined and does not necessarily reflect the actual order in which the rules were executed.

If an event does not trigger actions as expected, verify first if it has matched the expected rule(s).

Decision Path section

• The Hierarchy table displays the two hierarchies executed for every event, real-time and near-time, and includes the elapsed time spent for each. The response time in a hierarchy totals the elapsed time of each campaign of this hierarchy as well as the elapsed time of each rule of each campaign.
• The Campaign table displays the list of all executed campaigns of both hierarchies. In general, the display order is the order of execution. The response time of a campaign is the time required to verify the campaign criteria and set up temporary tables used for processing all rules.

  This is not the sum of the elapsed time of all the campaign's rules!

  If the Matches column displays 1, this event matches this campaign's criteria. The History Matches column enables you to check if a campaign takes considerably more time than others. This column shows how many events match the campaign criteria within the period under review (the campaign's history criteria). If the processing of events is slow, one reason could be the extraordinary complexity of a given campaign or a campaign's history criterion.

• The Rule table displays the list of all executed rules. In general, the display order is the order of execution.

  The response time of a rule is the time taken to verify the rule criteria and, if the rule matches, to execute actions (generate an alert, execute a workflow, update a hot list). The Matches column highlights the rules that have matched the current event. For every matched rule, the Workflows Launched An action in Risk Analytics Presentation Service that serves to start and/or customize a workflow to connect the selected item to a remote process or workflow. and Alert Category Placement An action in Risk Analytics Presentation Service that serves to raise an alert for a matched record and make it available in the SUPERVISE & INVESTIGATE menu for further review. columns display the number of each performed action. For a Hot List Record Management action, the Workflows Launched counter is increased by the number of hierarchies where the hot list exists. If the processing time for a rule is long, even if the event does not match the rule, the rule criteria could be too complex or could have too many conditions.

  For certain rule types, longer processing times to check the criteria are normal - processing time can be long for History rules and even longer for Match rules.