An incident is triggered by a rule in a Decision Strategy (e.g payments.strategy). Decision strategies are designed to be the last piece of logic executed prior to an event being created.
When defining a rule in a decision strategy, you are given the opportunity to define one-or-more remedations - these include
- adding or removing of labels to key identifiers on the event
- setting of attributes
- adding the event to an incident
Triggering an incident
A event must have its result terminated with a rule in order to trigger an incident. When an event is terminated you must specify an initial disposition (Accept, Reject, Alert, Review, Challenge)- this is an indicator of what the engine or your rules believe an outcome to be. It is important that you set a disposition as this enables Darwinium to later determine KPIs such as false positive rates.
Rules below a result terminate are still evaluated, but no longer will determine the decision strategy result or trigger additional incidents. So the higher priority rules and queues should be configured higher in the strategy.
Note: You will still see the signal of those lower rules if they fire.
When triggering an incident, you are given a number of options in the rule:
- The queue the incident will appear. Details on queue configuration can be found in Configuring Queues
- The mechanisms under which subsequent events matching the rule criteria will be grouped into incidents. An example of this might be grouping subsequent events with the same primary IP address into the same single incident.
This is highly configurable:
- Infer from rule - observes the rule logic and picks the best means of grouping. This is particularly useful when decisioning from a feature value
- Do not group - means that each subsequent incident will contain only 1 event
- Manually specify grouping - enables the rule author to specify the common event identifiers and attributes (such as a device signature, IP address, username, or a combination of these) under which subsequent events will be grouped into incidents for review