topic Re: Delete of Domains in SAS Visual Investigator 10.6 in Fraud, AML and Security Intelligence

Delete of Domains in SAS Visual Investigator 10.6

chaudharydeepak — Wed, 08 Jul 2020 11:23:51 GMT

Hi team,

I'm working SAS Visual Investigator 10.6. I want to know how I can delete domains from the SAS Visual Investigator.

Thanks.

Re: Delete of Domains in SAS Visual Investigator 10.6

_austin_ — Thu, 09 Jul 2020 03:28:14 GMT

Hello,

Although the UI doesn't currently allow you to delete a domain, you can delete it from a REST call. You will have to delete any alerts associated with that domain first. The curl statement for the delete is shown below.

exec curl -I -X DELETE "http://$HOST:$PORT/svi-alert/domains/$DOMAIN_ID" \
  --header "Content-Type:application/json" \
  --header "Authorization: Bearer $TOKEN"

Re: Delete of Domains in SAS Visual Investigator 10.6

chaudharydeepak — Sat, 25 Jul 2020 06:22:48 GMT

Hello ,

It works thanks a lot.

Re: Delete of Domains in SAS Visual Investigator 10.6

shravanisreeyan — Wed, 16 Sep 2020 05:13:31 GMT

Hi, can please tell me Why do we use domain window in SAS Visual investigator?what is the use?

Re: Delete of Domains in SAS Visual Investigator 10.6

_austin_ — Wed, 16 Sep 2020 14:56:19 GMT

Are you asking "what are alert domains good for"?

If that is the question, I would explain it this way. Visual Investigator is meant to be an enterprise-level solution. So it may be used by multiple groups in a company for different reasons. For example, a domain can be used to represent a business unit, such as anti-money laundering or fraud. One of the principles of the alert framework is that we pull together all the suspicious activity for an "actionable entity" (the entity you need to investigate) into a single alert. But in a big system, different businesses could be investigating the same entity for different reasons. You probably don't want the fraud indicators triaged together with the money laundering activity or the insider threat activity. Each of those "alerting domains" are worked by different people, showing different information and behaving differently. For this reason, tagging your alerting event data by alert domain separates the alerts, guaranteeing that information from one source can be worked independently from information about another source.

Re: Delete of Domains in SAS Visual Investigator 10.6

shravanisreeyan — Tue, 22 Sep 2020 12:40:10 GMT

Why do we create bridge table while creating relationships between entities ??On what basis we are creating?