6  Transaction Monitoring Batch Details

Transaction Monitoring uses Scheduler to create, schedule, execute and manage batches in Transaction Monitoring. A batch is a combination of tasks that are scheduled to run at a defined interval of time. A batch contains a StartBatch, Endbatch, and other tasks.

Figure 32: Flow of Batch

Pre-configured Batches in Transaction Monitoring 

Transaction Monitoring contains certain pre-configured batches that can be used to run the default data. You must create new batches to run customer-specific data.

To execute the batches, you must use Schedule Batch feature in the Scheduler Service. For more information, see Scheduler Service.

Transaction Monitoring contains the following pre-configured batches that must be executed in the following sequence:

Table 20: Pre-configured Batches and their Sequences

Ingestion Batch Details

The Ingestion batch runs the data pipelines, filters the data and prepares the data for further processing. Therefore, Ingestion batch must be run first.

This batch loads the data from staging to the business table in the specified order. The loading process receives, transforms, and loads Market, Business, and Reference data that is required for event detection.

The following table provides the tasks that are configured for the Ingestion batch. These tasks must be executed in the following sequence:

Table 22: Ingestion Batch Details

TMScenario Batch Details

The TMScenario batch makes use of the data that is prepared during ingestion and executes the scenario pipelines in the configured sequence and generates events. For more information on scenarios configured in Transaction Monitoring, see TSD Documentation.

The following table provides the tasks that are configured for the TMScenario batch.

These tasks must be executed in the following sequence:

Table 23: TMScenario Batch Details

CMExpress Batch Details

DM Utility in CMExpress moves data from AM to CM tables. It loads Event, Business as well as Evented related tables. Once the data is moved to consolidation tables then it is used for Correlation. Cases are generated after correlation.

You must perform certain pre batch configurations before executing the CMExpress batch. For more information, see Pre Batch Execution Configuration.

The following table provides the tasks that are configured for the CMExpress batch. These tasks must be executed in the following sequence:

Table 24: CMExpress Batch Details

AMLRedaction Batch Details

The AMLRedaction batch runs the data redaction.

The following table provides the tasks that are configured for the AMLRedaction batch. These tasks must be executed in the following sequence:

Table 21: AMLRedaction Batch

Pre Batch Execution Configuration

You must perform the following pre batch configurations before executing the CMExpress Batch.

·       Start a Batch

·       Configuring Correlation Rules

·       Correlation Case Type Mapping

Start a Batch

Follow these steps before starting a batch:

1.      To add parameters for the ECMSRTBTH task in CMExpress Batch, follow these steps:

a.     Navigate to the Transaction Monitoring   page.

b.    Click  to access the Navigation List. The Navigation List displays the list of modules.

c.     Click Scheduler in the Navigation List. The Scheduler Service page opens in a new window.

d.    Define tasks for the ECMSRTBTH task in the CMExpress Batch. For more information on defining tasks to batches, see the Define Tasks section.

e.     Add the following parameters to the ECMSRTBTH task in CMExpress Batch.

Table 25: Parameters in CMExpress Batch

2.     When the Start Batch run is executed, it loads the data to the FCC_CM_BATCH_RUN table.

Configuring Correlation Rules

After events are correlated to business entities, the event-to-business entity relationships are used to correlate events to each other. Events are grouped into a correlation if they share common business entities, and if they meet the criteria defined in the Event Correlation Rules. The logic of an Event Correlation Rule is defined in the FCC_CM_CORRELATION_RULE table.

The following is an example of the rule logic defined in FCC_CM_CORRELATION_RULE table:

Table 26: FCC_CM_CORRELATION_RULE table

·       N_CORRELATION_RULE_SKEY (optional): This is the correlation rule unique Identification number.

·       V_RULE_NAME (required): Defines the name of the correlation rule.

·       N_PATH_PRECEDENCE (required): Number indicating the maximum precedence value that a business entity shared between events must have to be considered a correlation by this rule. The lower the precedence number the stronger the relationship. Events are not considered for the correlation unless the precedence number associated with the business entity-to-event is less than or equal to (<=) the value defined.

·       V_EVENT_FILTER_OPERATIONS and V_EVENT_LINK_OPERATIONS (required): Defines operations used to further constrain the events to be used for correlation. An operation consists of an event attribute compared to a numerical value, such as from event and to an event which can be correlated if they both have V_EVENT_TYPE='AML', represented by source.V_EVENT_TYPE='AML', or a from event and to event which can be correlated if source.V_DATA_ORIGIN='SIN'. The set of supported comparison operators are: =, !=, <, >, <=, >=, IN, and NOT IN.

·       Multiple operations can be joined together by logical AND and OR operators and operation precedence can be defined with parentheses.

·       N_LOOKBACK_VALUE (required): The number attribute indicates the number of days to lookback from the current date or time to create a time window to consider events for correlation. This is a create timestamp of the event.

·       V_LOOKBACK_UNIT (required): The unit attribute identifies the unit of the lookback number. Possible values are D and CM for days and current month, respectively. All of these require a valid number value except for CM, which essentially makes the lookback the first of the current month, such as if the current date is October 14, we will lookback to October 1 if the CM unit is selected. The create timestamp of the event is used to determine whether or not an event falls within the lookback period.

·       F_EXTEND_FLAG (required): Defines the conditions for extending existing correlations. When a new correlation is discovered, it is possible that it is a superset (with only the triggering event not already included in the existing correlation) of a correlation that is previously identified. F_EXTEND_FLAG defines whether this correlation rule can result in extending an existing correlation. If this is set to FALSE (do not extend) then a new correlation is created when this condition is identified. If F_EXTEND_FLAG is set to TRUE then the existing correlation is added to unless it is already promoted to a case that has a status identified in the V_CASE_STATUS tags of NonExtendableCaseStatuses.

·       F_CORRELATION_REQUIRED_FLAG (required): Defines the conditions for correlation required. You can set this as Y or N. If this is set to N, then every event is self-linked and promoted to the case. If this is set to Y, then multiple events are linked if they have a common business entity and promoted to the case.

·       F_LOOKBACK_PROCESS_IND (required): Indicates if the date of lookback is event processing date or sysdate. If this is set to 1, then the processing date is picked. If this is set to 0, then the event created date is picked.

·       V_STATUS (required): Defines the status of correlation rule. By default, the correlation rule is Active.

§       To deactivate a correlation rule, modify the V_STATUS value to INACT.

§       To activate a correlation rule, modify the V_STATUS value to ACT.

§       Changes made to the metadata are effective immediately and are utilized the next time correlation is run.

Correlation Case Type Mapping

Define the Case Type mapping before executing the batch. This is performed using FCC_CM_CORRELATION_CASE_TYPE_MAP table.

Table 27: FCC_CM_CORRELATION_CASE_TYPE_MAP table

·       N_CORRELATION_RULE_SKEY: This is the correlation rule unique Identification number.

·       V_CASE_TYPE: This is the type of case. The entry should be the same as mentioned in fcc_cm_case_type_b table.

To perform this activity, follow these steps:

Add a new entry in FCC_CM_CORRELATION_CASE_TYPE_MAP table. For example, N_CORRELATION_RULE_SKEY can be 1, 2, 3 and V_CASE_TYPE can be AML_DD, AML_TER, AML_PAT.

Creating and Configuring New Batch in Transaction Monitoring 

You must create new batches to run customer-specific data.

To create and configure a new batch, follow these steps:

1.      Navigate to the Transaction Monitoring   page.

2.     Click  to access the Navigation List. The Navigation List displays the list of modules.

3.     Click Scheduler in the Navigation List. The Scheduler Service page opens in a new window.

4.    Define a batch. This option enables you to create a new batch. For more information, see the Define Batch section. For information on defining batches in Transaction Monitoring  , see Defining Tasks for Transaction Monitoring  Batches.

5.     Define a task. This option enables you to add new tasks to the selected batch definition.

For more information, see the Define Tasks section.

For information on configuring tasks for batches in Transaction Monitoring batches, see Defining Tasks section.

6.    Schedule a batch. This option enables you to run a batch. For more information, see the Schedule Batch section.

7.     Monitor a batch. This option enables you to view the status of the executed Batch along with the details of the task. For more information, see the Monitor Batch section.

Defining Batches for Transaction Monitoring 

To define batches for Transaction Monitoring, you must configure the Transaction Monitoring   batches as follows:

Table 28: Defining Batches for Transaction Monitoring

Table 29: Parameter Details for Defining the Transaction Monitoring Batches

Defining Tasks for Transaction Monitoring Batches

To define tasks for Transaction Monitoring, you must configure the Transaction Monitoring batches as follows:

Table 30: Task Details for Defining the Transaction Monitoring Batches