Distinct Count Of | Darwinium

Find The: Distinct Count Of

distinct_count_of

A count of the unique values, or unique combinations where more than one attribute is selected, of a set of one or more attributes over the given time period.

For example:

The number of Device Signatures associated with an Account.
The number of Mouse or Touch Signatures associated with a Device Signature.
The Number of unique accounts that this IP attempted to log in to in the last 10 minutes.
The Number of time zones this account has been seen in.

Configuration

Feature Name: The "dictionary" name under which the feature value will be stored and referenced by in rules.
Attributes: Selects which attribute(s) to measure the unique value or combination of. Only Identifier and Subject attributes can be used.
For Events:
- With The Same: Provides a way of filtering past events based on the attribute values. There must be at least one Identifier and only Identifier and Subject attributes can be used.

Optional Configuration

Default Value: A value that can be assigned to the feature if the attributes to calculate the features are not present.
Scope: Can be used to extend the event search from the local node, to all nodes within the same organization all the way to all across customers (global).
For Events:
- All event types: Default, no filter
- Same as current: Filter by event_type of event being processed
- Specific event type: List out the event_type to restrict to, as a list. Example: only consider account_login_success.
Condition: A Query-Language filter that can be used to refine Features for specific use cases.
Time Window: Can be used to limit the Feature calculation to a specific time period/window. e.g 1 week. Default is all ; no time window
Starting: Can be used to remove recent events from Feature calculation. Default is immediately ; no lag.

Use Case 1

Calculate the number of Device Signatures that have logged into an Account within a 3 month period.

Using the Feature in Rules and Investigations

Find an account being logged into from an unusual number of devices.

feature('device_sig_for_account_3mth') >= 5

Implementing In The Feature Editor

  - name: device_sig_for_account_3mth
    default_value: 0
    time_window:
      months: 3
    starting: immediately
    find_the:
      distinct_count_of:
        attributes:
          - device_signature['VER_1'].identifier
        for_events:
          event_type:
            - account_login_success
          include_current_event: false
          with_the_same:
            - identity['ACCOUNT'].customer_token.customer_token
    with_scope: same_node_instance