Velocity Of | Darwinium

Find The: Velocity Of

velocity_of

A count of the number of times that a group of Identifier/Subject attributes with the same value as the current event occured over the given time period.

For example:

The Number of login attempts within a seven day period.
The Number of successful logins this user made with this device, in the last month, excluding today.
The Number of HTTP requests from an IP address in last 15 minutes.

Configuration

Feature Name: The "dictionary" name under which the feature value will be stored and referenced by in rules.
For Events:
- With The Same: Provides a way of filtering past events based on the attribute values. There must be at least one Identifier and only Identifier and Subject attributes can be used.

Optional Configuration

Default Value: A value that can be assigned to the feature if the attributes to calculate the features are not present.
Scope: Can be used to extend the event search from the local node, to all nodes within the same organization all the way to all across customers (global).
For Events:
- All event types: Default, no filter
- Same as current: Filter by event_type of event being processed
- Specific event type: List out the event_type to restrict to, as a list. Example: only consider account_login_success.
Condition: A Query-Language filter that can be used to refine Features for specific use cases.
Time Window: Can be used to limit the Feature calculation to a specific time period/window. e.g 1 week. Default is all ; no time window
Starting: Can be used to remove recent events from Feature calculation. Default is immediately ; no lag.

Use Case 1

Calculate the number of Account Creation events (Account Creation Velocity) made by the Device Signature from the current event over the last 7 days.

Using the Feature in Rules and Investigations

Find a device creating accounts in bulk: three or more account creations in a week.

feature('device_creations_week') >= 3

Implementing In The Feature Editor

  - name: device_creations_week
    default_value: 0
    time_window:
      weeks: 1
    starting: immediately
    find_the:
      velocity_of:
        for_events:
          event_type:
            - account_creation
          include_current_event: true
          with_the_same:
            - device_signature['VER_1'].identifier
    with_scope: same_node_instance