14 Managing Threshold Sets

FCCM TM Cloud Service uses tunable Thresholds to change variable values for scenarios. When scenarios are created or installed, thresholds are established.  Once the application is in the production environment, you can use the Threshold Editor to modify threshold values of user-created scenarios, and create and edit threshold sets to fine-tune how that scenario finds matches, without changing the values defined at the dataset or pattern level. These thresholds are applied to scenarios to find matches. Using this tool, you can enter a new value for a threshold (within a defined range) or reset the thresholds to their sample values.

Threshold sets allow you to run the same scenario multiple times against a variety of sources (for example, currencies, or jurisdictions) with separate threshold values for each source.

NOTE:   

Changing threshold values can generate significantly more or fewer alerts, depending upon the modifications made.

Pre-configured threshold sets cannot be edited or deleted. You can only edit or delete user-defined threshold sets or copies of pre-configured threshold sets.

To access the All Threshold Sets page and view threshold sets, follow these steps:

1.     In the Navigation List menu, select Pipeline Administration.

2.     Select Threshold Manager. The All Threshold Sets page displays the complete list of threshold sets available in your implementation.

3.     Select the check box for the threshold set you want to view, or click the threshold set name to view the threshold set details.

 

Copying a Threshold Set

To copy and modify an existing threshold set, follow these steps:

1.     Navigate to the Threshold Manager page.

2.     Select the check box for the threshold set you want to copy.

3.     Click Copy  . The Copy Threshold Set window displays.

4.     Enter the following values:

§       Enter a Name for this threshold set.

§       The scenario associated with this threshold set  displays additional configurable parameters. These parameters are specific to the selected scenario.

§       Select one or more Jurisdictions for this threshold set using the drop-down list. Jurisdiction refers to the division of data in the database based on criteria such as geographical boundaries, legal entities, and so on.

§       Enter the Lookback Period for this threshold set. Lookback period refers to the number of seconds, minutes, hours, or days to lookback from the current date or time to create a time window which is used to consider cases for correlation.

§       Enter the Frequency Period for this threshold set. Frequency period refers to how frequently the scenario should be run.

§       Enter any Comments you have for this threshold set.

§       Enter the threshold values you want this threshold set to be updated with in the New Value field.

5.     Click Save.

Creating a Threshold Set

To create a new threshold set, follow these steps:

1.     Navigate to the Threshold Editor  page.

2.     Click Add in the top right corner.  The New Threshold Set page is displayed

3.     Enter the following values:

§       Enter a Name for this threshold set.

§       Select the scenario pipeline to be associated with this threshold set from the drop-down list. Depending on the scenario selected, additional configurable parameters are displayed. These parameters are specific to the selected scenario.

§       Select one or more Jurisdictions for this threshold set using the drop-down list. Jurisdiction refers to the division of data in the database based on criteria such as geographical boundaries, legal entities, and so on.

§       Enter the Lookback Period for this threshold set. Lookback period refers to the number of seconds, minutes, hours, or days to lookback from the current date or time to create a time window which is used to consider cases for correlation.

§       Enter the Frequency Period for this threshold set. Frequency period refers to how frequently the scenario should be run.

§       Enter any Comments you have for this threshold set.

§       Enter the values you want for this threshold set, if different than the default values  provided, in the New Value field.

4.     Click Save  to save the changes. A new threshold set is created and a message displays: New Threshold Set created successfully.

Or:

Click Save & Simulate. A new threshold set is created, and the Create Simulator Conditions page displays. For more information about the Threshold Simulator, see Threshold Simulator.

Editing Threshold Set

 

NOTE:   

Pre-configured threshold sets cannot be edited or deleted. You can only edit or delete user-defined threshold sets.

To edit a threshold set, follow these steps:

1.     Navigate to the Threshold Editor page. The existing threshold sets are displayed.

2.     Select the check box for the threshold set you want to edit.

3.     Click Edit Edit Threshold icon.  The Edit Threshold page is displayed.

Alternatively, you can click Edit when viewing a threshold set in the View Threshold Set window.

4.     Modify the required details.

§       Select one or more Jurisdictions for this threshold set using the drop-down list. Jurisdiction refers to the division of data in the database based on criteria such as geographical boundaries, legal entities, and so on.

§       Enter the Lookback Period for this threshold set. Lookback period refers to the number of seconds, minutes, hours, or days to lookback from the current date or time to create a time window which is used to consider cases for correlation.

§       Enter the Frequency Period for this threshold set. Frequency period refers to how frequently the scenario should be run.

§       Enter the values you want for this threshold set in the New Value field.

NOTE:   

You can modify the values of the existing parameters only, you cannot add new parameters.

5.     Click Save  to save the changes. The modified threshold set is saved.

Or:

Click Save as New to save the edited threshold set as a new threshold set. The New Threshold window opens. Enter a name for the threshold set and click Save. A new threshold set is created and a message displays: New Threshold Set created successfully.

Or:

Click Save & Simulate. A new threshold set is created, and the Create Simulator Conditions page displays. For more information about the Threshold Simulator, see Threshold Simulator.

Adding Additional Threshold Conditions

In order to improve the accuracy of your detection results and reduce false positives, you can add additional threshold conditions to detect only those behaviors which meet a combination of specific criteria.

To add additional threshold conditions to a high level dataset, follow these steps:

1.     Navigate to the scenario you want to further define in the Pipeline Designer by selecting Pipeline Administration, then Pipeline Designer, and selecting the scenario.

The Pipeline Designer displays for the scenario.

2.     Select Edit in the High Level Dataset widgetHigh Level Dataset widget.  The Threshold Editor displays for this dataset.

3.     Select Add Additional High Level Dataset Add Additional High Level Dataset for the threshold that you wish to define further, for example, Account Business Type. The Additional Condition window opens for this threshold.

4.     Click Add. Under Output, click Add again.

5.     Select an item from the drop-down list to include in the threshold conditions for this scenario. Modify the details as desired. The Output section displays the new condition.

If desired, click Add and select another item from the drop-down list.  

Clicking Add under output from the same condition joins these conditions as an AND condition.  Clicking Add from the right hand side of the Additional Condition window joins the conditions as an OR condition. The following image provides an example:

 

Sample High Level Dataset window

Sample High Level Dataset Output

You can continue to add and select threshold conditions until you are satisfied with the granularity of the threshold conditions.

6.     When you have finished adding all the threshold conditions, click Save.

 

Deleting Threshold Set

NOTE:   

Pre-configured threshold sets cannot be edited or deleted. You can only edit or delete user-defined threshold sets.

To delete a threshold set, follow these steps:

1.     Navigate to the Threshold Editor page. The existing threshold sets are displayed.

2.     Select the check box corresponding to the threshold set you want to delete.

3.     Click Delete Delete Threshold Set icon. A message displays: Are you sure you want to delete <threshold set>?

4.     Enter the reason for deletion in the Your Comment box. This is mandatory.

5.     Click Delete. The threshold set is deleted.