5 Managing Scoring Pipelines

A Scoring Pipeline is used to calculate Event and Correlation scores, and define Decision Rules for case promotion. Logical conditions are used to define the Event and Correlation scores. These logical conditions are grouped in Rules.

Scoring can be performed on events or correlations. The Pre-Case score is the sum of score of all events and the correlation.  Events are promoted to case based on decision rules which run on the pre-case score calculated earlier.

After creating the Jurisdiction in the system, create a pre-case decision rule in the scoring pipeline with respect to the Case Type, Jurisdiction combination. You need to take a copy of the existing pipeline and create the decision rule.

You cannot use the default ECMProcess Batch unless you configure a Case Scoring Pipeline and associate it with the Batch.

Scoring Pipeline

A scoring pipeline has the following major operations:

·        Correlation Scoring: Scoring each correlation based on the defined rules and condition.

·        Event Scoring: Scoring each event based on the defined rules and condition.

·        Moving Scoring Data: The result of the event scoring and correlation scoring rule sets are moved to the related tables in Case Management and then the Pre-Case score is calculated.

·        Pre-case Decision: Rules defining a threshold through which decision to promote a correlation to a case is taken.

Widgets in Scoring Pipelines

The following table lists the widgets available in a scoring pipeline.

Widgets in Scoring Pipeline and their Descriptions

Pre-configured Rules in Scoring Pipelines

FCCM TM Cloud Service comes with the following set of ready-to-use scoring pipelines.

·        Rules in Correlation Scoring Pipelines

·        Rules in Event Scoring Pipelines

·        Rules in Pre-case Decisions

Rules in Correlation Scoring Pipeline

The following table lists the ready-to-use Correlation Scoring Pipeline Rules.

Rules in Correlation Scoring Pipeline

Rules in Event Scoring Pipeline

The following table lists the ready-to-use Event Scoring Pipeline Rules.

Rules in Event Scoring Pipeline

Rules in Pre-case Decision

The following table lists the ready-to-use Pre-case Scoring Pipeline Rules.

 Pre-Case Scoring Pipeline

NOTE:   

These ready-to-use scoring pipelines are not editable. You can make a copy of the pipeline and edit the scoring rules.

Creating Scoring Pipeline

To create a scoring pipeline, follow these steps:

1.     Navigate to the Pipeline Designer page.

2.     Follow the steps in Creating_a_Pipeline to create a new scoring pipeline.

3.     Drag and drop the Scoring Widgets (Correlation, Event, External Services, and Pre-case Decision) from the widgets pane in the upper-right corner to the designer pane. It is recommended to use the Standard flow.

4.     Connect the widgets in correct order as mentioned in the Flow of Scoring Pipeline section.

5.     Hover on the scoring widget and click Edit .

6.     Define the following scoring pipeline components:

§       Correlation Scoring

§       Event Scoring

§       External Service

§       Pre-case Decision

Step1: Defining Correlation Scoring Rule

To create rules for Correlation Scoring, follow these steps:

1.     Hover on the Correlation widget and click Edit . The Ruleset Details window is displayed for the Correlation Scoring widget.

2.     Provide the details as described in the following table.

Fields to Define Correlation Scoring Pipeline and their Descriptions

3.     To add a rule, click Add  on the left (Rules pane) and specify conditions for the rule. You can add multiple rules and multiple conditions under each rule. For more information, see the Adding a Rule section.

4.     Click Save  to save the changes.

5.     Add more rules as needed to define all the rules for Correlation Scoring.

6.     You can perform certain tasks that are common in all the widgets, such as edit, delete, filter, and so on. For more information, see the Common Tasks section.

Step 2: Defining Event Scoring Rule

To define an event scoring, follow these steps:

1.     Hover on the Event widget and click Edit . The Ruleset Details window is displayed for the Event Scoring widget.

2.     Provide the details as described in the following table.

Fields to Define Event Scoring Pipeline and their Descriptions

3.     To add a rule, click Add  on the left (Rules) and specify conditions for the rule. You can add multiple conditions under each rule. For more information, see the Adding a Rule section.

4.     Click Save  to save the changes. The event scoring rule is created.

5.     Add more rules as needed to define all the rules for Event Scoring.

6.     You can perform certain tasks that are common in all the widgets, such as edit, delete, filter, and so on. For more information, see the Common Tasks section.

Step 3: External Service

This is a persist widget that moves the data from rule set result table to main scoring tables. That is, scoring data will move from the FCC_M_CM_RULESET_RESULT table to the FCC_CM_CORRELATION_SCORE table for correlation scoring and the FCC_CM_EVENT_SCORE table for event scoring, respectively. Before moving the data to the main scoring table, data will be stored in the CC_M_CM_RULESET_RESULT table from event scoring and correlation scoring. You cannot make any changes in this widget. For more information about the Persist widget, see Creating a Persist.

Pre-case score is performed on event scoring and correlation scoring. For example, there are Event A, Event B, and Event C in the system, then the pre-case score is the sum of Event A + Event B + Event C + Correlation Score.

If the pre-case score does not cross the promote to case threshold, it remains in only the pre-case layer.

To move the scoring data after creating a correlation scoring widget and defining the correlation and event scoring rules, follow these steps:

1.     Hover on the Pre-case Decision widget and click Edit  . The External Service window is displayed. Select Move Scoring Data from Name drop-down list.

Step 4: Pre-case Decision

Based on decision rules which run on the pre-case score calculated earlier, correlations are promoted to case. Using this widget, you can define threshold value and if the pre-case score crosses this threshold value, the correlation is promoted to case.

To define threshold value, follow these steps:

1.     Hover on  the Pre-case Decision widget and click Edit . The Pre Case Decision window is displayed.

2.     Provide the details as described in the following table:

Fields to Define Pre-case Decision and their Descriptions

3.     Click Save  from Add Rule section.

4.     Click Save  from the top-corner of the window to save the changes. After defining the rule,  the Scoring page is displayed.

You can use Edit   to edit the rule or click Delete   to delete the rule.

Adding a Rule

Rules are logical comparisons against conditions that result in a score.

To add a rule, follow these steps:

1.     Navigate to the Rules section of the Scoring page.

2.     Enter a name for this rule.

3.     Enter a score for this rule.

4.     Define the conditions. You can add multiple conditions.

·        Left Expression: Select the expression on which rule must be operated. The following two types are available:

§       Profiles: are an aggregation of information. Profiles can be based on different grouping entities and can be filtered to only look at kinds of transactions. By default, Event Count, Total Transaction Count and Total Transaction Amount profiles are available. You can also use filters on profile. For more information, see Adding Filters.

§       Attributes: this list is the group of data condition such as correlation, generated events, and so on.

§       Operator: select the operator from the Operator drop-down list for the expression and also the expression that it is to be operated on. The available operators are IN, =, >, <, <=, >=, and <>.

·        Right Expression: Provide the value on which the left expression and operators will work.

5.     Click Save  to save the Rule.

Examples

This section provides some examples of scoring.

Example of Correlation Scoring

In the following example, the correlation scoring rule-based Event Count and Total Transaction Amount is defined as follows:

Correlation 1: Total Transaction Amount = 170000, Event Count =3

Correlation 2: Total Transaction Amount = 180000, Event Count = 7

Correlation 3: Total Transaction Amount = 50000, Event Count = 8

·        Define a rule (Rule1) with the score 30 based on the following conditions:

·        Conditions: Transaction Amount >= 100001 and Transaction Amount < 500001,

·        Result: Correlation 1 and Correlation 2 will be assigned a score as 30.

·        Define a rule (Rule2) with the score 50 based on the following conditions:

·        Conditions: Event Count > 5 and Event Count < = 10

·        Result: Correlation 2 and Correlation 3 will be assigned a score as 50.

Follow these steps to define this use case:

1.     Add a rule (Rule1) using Add  from the Rules window. The Rules window is displayed. Enter the Rule Name, Description, and Score as 30.

2.     Define condition 1 and condition 2 as Transaction Amount >= 100001 and Transaction Amount < 500001.

Example of Correlation Scoring – Condition 1

3.     Click Save .

4.     Add a rule (Rule2) using Add  from the Rules window The Rules window is displayed. Enter the Rule Name and Score as 50.

5.     Define the condition 1 and condition 2 as Event Count > 5 and Event Count < = 10

Example of Correlation Scoring – Condition 2

6.     Click Save .

7.     After defining the scoring rules, the total correlation score will be calculated based on the Score Aggregation Type. There are three Score Aggregation Types as shown in the following table.

Score Aggregation Types

Example of Event Scoring

The following example shows how to create a rule based on the Total Transaction Amount and Jurisdiction conditions:

Event 1: Total Transaction Amount = 17500, Jurisdiction code = AMEA

Event 2: Total Transaction Amount = 4000, Jurisdiction code = INDA

Event 3: Total Transaction Amount = 5000, Jurisdiction code = EMEA

·        Define a rule (Rule 1) with the score 50 based on the following conditions:

§       Conditions: When Total Transaction Amount > 10000

§       Result: Event 1 and Event 2 will be assigned a score as 50.

·        Define a rule (Rule 2) with the score 30 based on the following conditions:

§       Conditions: Total Transaction Amount < = 10000

§       Result: Event 3 will be assigned a score as 30.

·        Define a rule (Rule 3) with the score 20 based on the following conditions::

§       Conditions: Jurisdiction code = AMEA

§       Result: Event 1 will be assigned a score as 20.

Follow these steps to define this use case:

1.     Add a rule (Rule1) using Add  from Rules window. The Rules window is displayed. Enter the Rule Name and Score as 50.

2.     Define the condition (Condition 1) as Total Transaction Amount >10000.

Example of Event Scoring – Rule 1

3.     Click Save .

4.     Add a rule (Rule 2) using Add  from the Rules window. The Rules window is displayed. Enter the Rule Name and Score as 30.

5.     Define the Condition 1 as Total Transaction Amount < = 10000.

Example of Event Scoring – Rule 2

6.     Click Save.

7.     Add a rule (Rule 3) using Add  from the Rules window. The Rules window is displayed. Enter the Rule Name and Score as 20.

8.     Define the Condition 1 as Jurisdiction code = AMEA.

Example of Event Scoring – Rule 3

9.     Click.

10.  After defining the scoring rules, the total event score will be calculated based on the Score Aggregation Type. There are three Score Aggregation Types as shown in the following table.

Score Aggregation Types