Documentation Index

Fetch the complete documentation index at: https://docs.darwinium.com/llms.txt

Use this file to discover all available pages before exploring further.

Time Since First

  • Published on Jun 7, 2024
  • 1 minute(s) read
  • CG
 Prev Next

Time Since First calculates the amount of time since the selected attributes(s) were first seen in an event. Time is measured in milliseconds for compatibility with other time functions.

For Example:

  • Determinining the "Age" of a device and/or other attributes. For example, if an account, device and IP network rage have repeatedly been seen together for 3 or more months, this is a positive indicator that the activity is legitimate.
  • Performing step-up authentication if the "Age" of a device is less than 1 day.

The diagram below provides a visual representation of how Time Since First is calculated:
Assuming Time Since First is configured for "Auction Listing" events with a 4 hour window, then it will select the "oldest" event occurring at 14:29. A value of 11,460,000 milliseconds (191 minutes) is returned.

image.png

Configuration

  • Feature Name
    The "dictionary" name under which the feature value will be stored.

  • For Events > With The Same

    • Only Identifier and Subject attributes can be used.
Note
  • At least one of the selected attributes must be an Identifier.
Optional Configuration
  • Default Value
    A value that can be assigned to the feature if the attributes to calculate the features are not present.
  • Scope
    Can be used to extend the event search from the local node, to all nodes within the same organization all the way to all across customers (global).
  • For Events
    Provides a way of filtering past events based on their type.
  • Condition
    A Query-Language filter that can be used to refine Features for specific use cases.
  • Time Window
    Can be used to limit the Feature calculation to a specific time period/window. e.g 1 week.
  • Starting ...
    Can be used to remove recent events from Feature calculation.

Use Case 1

Obtaining the "age" of the combination of device signature, account and TCP network prefix to be used as a positive indicator for "good" returning users.

Implementing In The Feature Editor

image.png

image.png

  - name: dev_acc_network_age
    default_value: 0
    time_window: all
    starting: immediately
    find_the:
      time_since_first:
        events:
          event_type: all
          include_current_event: false
          with_the_same:
            - device_signature['VER_1'].identifier
            - identity['ACCOUNT'].login.login
            - profiling.tcp_connection['WEBRTC'].network_prefix
    with_scope: same_node_instance