topic Visual Investigator alerts reopening after workflow execution in Fraud, AML and Security Intelligence

Visual Investigator alerts reopening after workflow execution

masiqmoselli — Wed, 04 Aug 2021 17:43:03 GMT

Hello all,

I'm using Visual Investigator 10.7 and whenever I close an alert it got active again after the flow execution. In other queues I got it solved (the action of move an alert from one queue to another after flow execution) with priority of strategies and queue.

I've noticed that when I close it manually by the disposition on PGAdmin it shows alert_status_id = 'CLOSED' and queue_id equals to the queue the alert was before I close it. But everytime flow runs it gets active.

Anyone have any suggestion?

Thanks.

Re: Visual Investigator alerts reopening after workflow execution

MBergeron — Wed, 04 Aug 2021 19:17:19 GMT

So it sounds like your flow is creating a new alert. If you don't think that should be happening you might start checking a few areas. Check your alert score aggregation policy to make sure it represents what you are trying to enable.

When the Do not compute a score from the provided activity or Compute the score from the activity in the current alerting event score aggregation policy is selected, the scorecard displays only the scenario-fired events in the current alerting event.
When the Compute the score from the unique alerting activity in all the alerting events score aggregation policy is selected, the scorecard displays all the scenario-fired events in the current alerting event as well as all the unique scenario-fired events in prior alerting events for this alert version.
When the Compute the score from all the activity in all the alerting events score aggregation policy is selected, the scorecard displays all the scenario-fired events in the current alerting event as well as all the events in prior alerting events for this alert version.

From what you said it sounds like the system is finding "new" activity and alerting on it. Example: An alert comes up for Joe Smith and a user dispositions it. That disposition creates a case and closes the alert. That alert only stays closed until new activity that meets the alerting threshold criteria comes into the system. If that isn't what you are wanting in terms of behavior you could look at the alert disposition option to keep the alert suppressed until the score in creases by % or X amount.

Reactivate after a Score Increase

Suppresses the alert and keeps it suppressed unless its score changes. You can specify whether the score must increase by a percentage or by an exact amount. You can indicate that the alert should be reactivated if the score goes above a specified value.

Re: Visual Investigator alerts reopening after workflow execution

masiqmoselli — Wed, 04 Aug 2021 20:12:20 GMT

I've tried use the Reactivate after a Score Increase, and even used some high percentages like 100%, but it still Activing alerts that was closed.

About the agregation scenarios, I'm not using it. I'm using the Scenario in row level (think that in english is that way), and I don't have any of the options.

Re: Visual Investigator alerts reopening after workflow execution

MBergeron — Wed, 04 Aug 2021 21:26:00 GMT

Close Alert and Reactivate After an Increase are separate and distinct disposition actions. If you have Close Alert checked it will invalidate your reactivate option completely. I'd unchecked the Close option if that is the case and try again with the Reactivate and whatever % threshold you felt was appropriate.