Data Elements and Operators Used for Building New Rules

CA RiskMinder Administration Guide › Managing Global Configurations › Managing Global Rule Configurations › Adding New Rules › Data Elements and Operators Used for Building New Rules

Data Elements and Operators Used for Building New Rules

You need the following elements to build a new rule:

Data Elements
Operators

Data Elements

Depending on the rule that you want to create, you can select from the following data elements:

Transaction Elements: Enable you to create a rule to identify suspicious transaction patterns on all channels.
Device Elements: Enable you to create a rule to identify risk associated with a particular device.
Geolocation Elements: Enable you to create a rule to analyze the user’s geolocation data from where the transaction was performed.
Model Elements: Enable you to create a rule to analyze a transaction based on the Model score.
Custom Elements: Enable you to create your own data element, which is not available in the list of pre-configured data elements. For a list of element names that you can use for custom elements, see "RiskMinder Rule Tags".

Operators

Operators that you use to create rules can be grouped into the following categories:

Expression: These operators are used to combine rule fragments to build a rule.
Possible operators include AND, OR, NOT, (, and ) operators.
Match Type: These operators are used by the IN_CATEGORY and IN_LIST operators. Possible operators include the following:
- EXACT: If the list value matches the input value exactly, then the rule is triggered.
- PARTIAL: If any of the values in the list is a partial subset of the input value, then the rule is triggered
LookUp Type: Possible operators include IN_LIST,IN_TRUSTED_LIST, and IN_NEGATIVE_LIST.
Operator: These operators are used for numeric comparison of data elements.
Possible operators include EQUAL_TO (=), NOT_EQUAL_TO (!=), GREATER_OR_EQUAL (>=), LESS_OR_EQUAL (<=), GREATER_THAN (>), and LESS_THAN (<).

The following table describes the transaction elements and the corresponding operators.

Data Element	When to Use	Operator Description
ACTION	If your rule needs to track whether one or more pre-defined actions is available in a list or performed during a particular duration.	IN_LIST:Checks whether the action performed is available in a simple look-up list. Only exact match is allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. VELOCITY:Checks whether the frequency of transactions of the specified set of actions have met or exceeded a pre-defined threshold and returns True if this condition is met. This rule is useful to detect situations where a prior password change makes the current transaction risky. For example, to check for a money transfer preceded by a password reset in the last 24 hours, you must set this rule Greater Or Equal To 1 In last 24 Hours for the FORGOT_PWD action in the For Set of Actions list. IN_CATEGORY: Checks for the action performed in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.
USERNAME	If your rule needs to check whether the transaction was performed by a particular user.	IN_LIST: Checks whether the user is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. VELOCITY: Checks whether the number of transactions for a particular user exceeds the limits set by the specified duration and frequency. ZONE_HOP: Checks for transactions that originate from the same user from large distances within a short interval. UNKNOWN: Checks whether the user is already registered in the RiskMinder database. IN_CATEGORY: Checks for the user in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.
CURRENTTIME	If your rule needs to identify suspicious transaction patterns based on the time the transaction was performed.	Compares the CURRENTTIME when the transaction was performed with the specified Time by using the following operators: – EQUAL_TO – NOT_EQUAL_TO – GREATER_THAN – LESS_THAN – GREATER_OR_EQUAL – LESS_OR_EQUAL IN_LIST: Checks whether CURRENTTIME is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for CURRENTTIME in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. Note: The format of CURRENTTIME is HHMM.
DATE	If your rule needs to identify suspicious transaction patterns based on the date the transaction was performed.	IN_LIST: Checks whether DATE is in a simple look-up list. Only exact match is allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. Compares the transaction DATE with the specified Date by using the following operators: – EQUAL_TO – NOT_EQUAL_TO – GREATER_THAN – LESS_THAN – GREATER_OR_EQUAL – LESS_OR_EQUAL IN_CATEGORY: Checks for DATE in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. Note: The format of DATE is YYYYMMDD.
DAYOFMONTH	If your rule needs to identify suspicious transaction patterns based on the day of the month when the transaction was performed.	IN_LIST: Checks whether DAYOFMONTH is in a simple look-up list. Only exact match is allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. Compares the DAYOFMONTH when the transaction was performed with the selected Day of Month by using the following operators: – EQUAL_TO – NOT_EQUAL_TO – GREATER_THAN – LESS_THAN – GREATER_OR_EQUAL – LESS_OR_EQUAL IN_CATEGORY: Checks for DAYOFMONTH in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. Note: DAYOFMONTH is a 2-digit number where 01=January, 02=February, and so on.
DAYOFWEEK	If your rule needs to identify suspicious transaction patterns based on the day of the week when the transaction was performed.	IN_LIST: Checks whether DAYOFWEEK is in a simple look-up list. Only exact match is allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for DAYOFWEEK in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. Note: Permitted values for DAYOFWEEK are SUNDAY, MONDAY, TUESDAY, WEDNESDAY, THURSDAY, FRIDAY, and SATURDAY.
MONTH	If your rule needs to identify suspicious transaction patterns based on the month the transaction was performed.	IN_LIST: Checks whether the transaction MONTH is in a simple look-up list. Only exact match is allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. Compares the transaction MONTH with the specified Month using the following operators: – EQUAL_TO – NOT_EQUAL_TO – GREATER_THAN – LESS_THAN – GREATER_OR_EQUAL – LESS_OR_EQUAL IN_CATEGORY: Checks for MONTH in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. Note: The format of MONTH is MM.
YEAR	If your rule needs to identify suspicious transaction patterns based on the year the transaction was performed.	IN_LIST: Checks whether the transaction YEAR is in a simple look-up list. Only exact match is allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. Compares the transaction YEAR with the specified Year using the following operators: – EQUAL_TO – NOT_EQUAL_TO \xE2\x80\x93 GREATER_THAN – LESS_THAN – GREATER_OR_EQUAL – LESS_OR_EQUAL IN_CATEGORY: Checks for YEAR in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. Note: The format of YEAR is YYYY.

The following table describes the transaction elements that are specific to the 3D Secure channel.

Data Element	When to Use	Operator Description
ACQ_BIN	If your rule needs to check the acquirer bin of the merchant where the transaction was made.	IN_LIST: Checks whether the Acquirer BIN is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for Acquirer BIN in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.
AMOUNT	If your rule needs to track transactions against a threshold amount in the specified currency. You can configure your rule to support automatic currency conversion. If this is enabled, then you need to only specify the threshold amount in your base currency. You may specify thresholds in additional currencies where you want to override the automatic conversion. For more information on the currency conversion table, see appendix, "Currency Conversion".	Compares the transaction AMOUNT with the specified amount using the following operators: – EQUAL_TO – NOT_EQUAL_TO – GREATER_THAN – LESS_THAN – GREATER_OR_EQUAL – LESS_OR_EQUAL IN_LIST: Checks whether the AMOUNT is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the AMOUNT in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.
CURRCODE	If your rule needs to check the 3-digit numeric code used for the transaction.	IN_LIST: Checks whether the currency code is in a simple look-up list. Only exact match is allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the currency code in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.
MERCHANT_ID	If your rule needs to identify suspicious transaction patterns based on the unique identifier of the merchant involved in the transaction.	IN_LIST: Checks whether merchant ID is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the merchant ID in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.
MERCHANT_NAME	If your rule needs to identify suspicious transaction patterns based on the name of the merchant involved in the transaction.	IN_LIST: Checks whether merchant name is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the merchant name in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.
MERCHANT_URL	If your rule needs to identify suspicious transaction patterns based on the URL of the merchant involved in the transaction.	IN_LIST: Checks whether the merchant URL is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the merchant URL in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.
MERCH_CAT	If your rule needs to identify suspicious transaction patterns based on the category of the merchant involved in the transaction.	IN_LIST: Checks whether merchant category is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the merchant category in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.
MERCH_COUN	If your rule needs to identify suspicious transaction patterns based on the country code of the merchant where the purchase is being made. MERCH_COUN is 3-digit ISO country code.	IN_LIST: Checks whether the merchant country is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the merchant country in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.
PREVTXNDATA	If your rule wants to check whether the previous transaction matches any of the selected actions in the specified number of hours. The rule returns True if a previous transaction type was the same as the selected type for this user in the specified time frame.	CHECK: Checks whether the type of the previous transaction performed in the specified duration for the given user matches one or more of the selected actions. The transaction types are: REGULAR: Regular purchase transaction. ATTEMPTS: Attempts transaction (user is not enrolled and the bank is permitted to notify the merchant that the bank attempted to authenticate the user). AE_WITH_PWD: Auto enrollment where all card holders have a valid password. AE_WITHOUT_PWD: Auto enrollment where some of the card holders may have empty passwords. FORGOT_PWD: Forgot password transaction. SEC_CH: Secondary Cardholder Addition (An additional card holder (username/password) was added to an existing card number). FORGOT_PWD_MULTI_CH: Forgot password transaction in a multiple cardholder scenario. FORGOT_PWD_SINGLE_CH: Forgot password transaction in a single cardholder scenario (This is the same as FORGOT_PWD). ABRIDGED_ADS: Activation during shopping with a temporary password. SEC_CH_ABRIDGED: Secondary cardholder through abridged registration. UNKNOWN: Unknown transaction type (this is an exceptional situation).

The following table describes the Device elements and the corresponding operators.

Data Element	When to Use	Operator Description
BROWSER	If your rule needs to check the browser from which the transaction originated.	IN_LIST: Checks whether the browser name is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the browser name in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. Note: Supported browsers are Mobile Safari, Android Webkit, Microsoft Internet Explorer, Firefox, Epiphany, K-Meleon, Konqueror, Minimo, Mozilla, SeaMonkey, Netscape, NetPositive, Novarra, OmniWeb, Opera, Safari, Camino, Shiira, Lynx, w3m, Chrome, CrMo, CriOS, Avant Browser, PSP, ELinks, Links, and OffByOne.
DEVICEID	If your rule needs to identify suspicious transaction patterns based on the ID of the device involved in the transaction.	VELOCITY: Checks whether the number of transactions performed by one or more users from a specific device exceeds the limits set by the duration and frequency. UNKNOWN: Checks whether the device is a recognized device. IN_LIST: Checks whether the Device ID is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the Device ID in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. VELOCITY_DISTINCT_USER: Counts the number of n distinct users who have done a transaction in the configured duration from the specific device. For more information, see "Creating the Device User Velocity Rule".
DEVICETYPE	If your rule needs to check for the type of device involved in the transaction.	IN_LIST: Checks whether the device type is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the device type in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. Note: Supported device types are PC, Mac, iPad, iPhone, Kindle, Android, Linux, BlackBerry, Nokia, iPod, PlayBook, Web OS, HP Tablet, Sony, PlayStation, and Nintendo Wii.
MFPMATCHPERCENT	If your rule needs to check for the Machine FingerPrint match.	Checks if the match percentage between the input device signature and the corresponding stored device signature is LESSER_OR_EQUAL to the following thresholds: Signature Match Threshold: Threshold against which match percentage is checked in cases where the transaction has a valid Device ID and the input signature is matched against the signature of the previous transaction. Reverse Lookup Threshold: Threshold against which match percentage is checked in cases where the Device ID is obtained by matching the input device signature against the device signatures that were successfully associated with the user.
OS	If your rule needs to check for the operating system used by the device involved in the transaction.	IN_LIST: Checks whether the operating system is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the operating system value in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. Note: Supported OSs are Windows 98, Windows 95, Windows NT 4.0, Windows NT 3.51,Windows NT, Windows CE, Windows, PPC Mac OS X Mach-O, PPC Mac OS X, Intel Mac OS X, PPC Mac OS, Intel Mac OS, Mac OS, Macintosh, Linux, FreeBSD, NetBSD, OpenBSD, Debian, Gentoo, Red Hat Linux, SUSE, CentOS, Fedora, Mandriva, PCLinuxOS, Ubuntu, OS/2, SunOS, PalmOS, Symbian, Darwin, J2ME/MIDP, PSP, iOS, and Android.

The following table describes the Geolocation elements and the corresponding operators.

Data Element	When to Use	Operator Description
CITY	If your rule needs to check for the city from which the transaction originated.	IN_LIST: Checks whether the city of origin is in a simple look-up list. Exact and partial matches are allowed. IN_CATEGORY: Checks for the city of origin in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. You can upload data to the data list and manage category mappings in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data.
CLIENTIPADDRESS	If your rule needs to check for the client IP address used to perform the transaction.	IN_TRUSTED_LIST: Checks whether the IP address of the client is in a pre-defined list of trusted IP addresses. IN_LIST: Checks whether the IP address is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. VELOCITY: Checks whether the number of transactions from this IP address exceeds the limits set by the duration and frequency. IN_NEGATIVE_LIST: Checks for anonymizing proxies. IN_CATEGORY: Checks for the IP address in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.
CONNECTIONTYPE	If your rule needs to check the type of connection used to perform the transaction. CONNECTIONTYPE indicates the type of connection to the Internet provider.	IN_LIST: Checks whether the CONNECTIONTYPE is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for CONNECTIONTYPE in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. For a list of possible values, see "Connection Type".
CONTINENT	If your rule needs to check for the continent from which the transaction originated.	IN_LIST: Checks whether the continent from which the transaction originated is in a simple look-up list. Exact and partial matches are allowed. RiskMinder derives the country information based on the input IP address. IN_CATEGORY: Checks for the continent from which the transaction originated in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. You can upload data to the data list and manage category mappings in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. For a list of continents, see "Continent".
COUNTRY	If your rule needs to check for the country from which the transaction originated.	IN_NEGATIVE_LIST: Checks whether the country of origin is in a pre-defined list of "negative" countries. IN_LIST: Checks whether the country of origin is in a simple look-up list. Exact and partial matches are allowed. RiskMinder derives the country information based on the input IP address. IN_CATEGORY: Checks for the country of origin in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. You can upload data to the data list and manage category mappings in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data.
IP_ROUTINGTYPE	If your rule needs to check for the IP routing type of the connection used to perform the transaction. IP_ROUTINGTYPE is an attribute of the IP address that helps assess the accuracy of the location.	IN_LIST: Checks whether the IP_ROUTINGTYPE is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see "". IN_CATEGORY: Checks for IP_ROUTINGTYPE in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. For a list of possible values, see "IP Routing Type" in appendix.
LINESPEED	If your rule needs to check for the speed of the user’s internet connection used to perform the transaction.	IN_LIST: Checks whether the LINESPEED is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for LINESPEED in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. For a list of possible values, see "Line Speed".
REGION	If your rule needs to check for the state from which the transaction originated.	IN_LIST: Checks whether the state of origin is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the state of origin in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. You can upload data to the data list and manage category mappings in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. For a list of possible values, see "Region".
STATE	If your rule needs to check for the state from which the transaction originated.	IN_LIST: Checks whether the state of origin is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the state of origin in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed. You can upload data to the data list and manage category mappings in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data.

The following table describes the Model Element and the corresponding operators.

Data Element	When to Use	Operator Description
MODEL_SCORE	If your rule needs to check for the resulting score from the model evaluation	Compares the model score with the specified value using the following operators: – EQUAL_TO – NOT_EQUAL_TO – GREATER_THAN – LESS_THAN – GREATER_OR_EQUAL – LESS_OR_EQUAL IN_LIST: Checks whether the model score is in a simple look-up list. Exact and partial matches are allowed. You can view the list and upload data to this list in the Manage List Data and Category Mappings page. For instructions to do so, see Uploading Rule List Data. IN_CATEGORY: Checks for the model score in a table in the mapping data set, and then compares the associated derived value of the input in a list data set. Exact and partial matches are allowed.