topic Re: Case entity enrichment fields in Fraud, AML and Security Intelligence

Case entity enrichment fields

Idanar — Sun, 30 Jul 2023 08:42:55 GMT

Hi experts,

I have a case entity, to which I want to configure (add) an enrichment field from the Alert entity.

Can anyone advise how can I add fields to the case entity through the Visual Investigator administrator interface?

My final wish is to be able to route a case to a manager IF the alert record is above a score of 80, and for that reason, I have to have a *Score* field at the Case entity.

Thanks in advance,

Idan

Re: Case entity enrichment fields

SASKiwi — Sun, 30 Jul 2023 21:21:03 GMT

Your question is very specialist and you are likely to get a quicker answer if you open a track with Tech Support.

Re: Case entity enrichment fields

susantrueman — Mon, 31 Jul 2023 08:35:22 GMT

Hello,

Please see this section of the documentation for details of how to set the enrichment fields on an object (such as a "Case") created by an alert disposition:

https://go.documentation.sas.com/doc/en/vicdc/10.8/visgatorag/defininig-add-to-object.htm#p0nfg8251iq0sbn1cbvwcxicq32n

You don't need to enter an access key when the documentation is opened from VI (or you are already logged into VI). If you do need an access key please contact SAS Technical Support.

Thanks

Susan

Re: Case entity enrichment fields

Idanar — Mon, 31 Jul 2023 10:22:48 GMT

Hi @susantrueman ,

I'm familiar with the documentation you sent, but it refers only to three fields (as far as I understood):

actionable_entity_nm
actionable_entity_type_nm
actionable_entity_id

So if I want to refer to curr_score_val field (which is the "Score" field I'm looking for), there is no reference on how can I define something like this. there is no documentation with examples even...

What can you advise? To reach SAS support team with a ticket to help me configure this? It's sound like something that should be very easy but yet...

Thanks,

Idan

Re: Case entity enrichment fields

susantrueman — Mon, 31 Jul 2023 14:31:19 GMT

Hello,

My understanding is that only a specific set of fields are copied from the alert to the case when it is created as the result of a disposition (I believe this is the 3 fields listed above and alert_id).

One option would be to add a related page control to the Case page template to show key information from the related Alert (you would need to define a traversal to be used to populate the related page control). The page template you associate with the alert and display in the related page control can be limited to only a subset of the fields from the alert.

Thanks, Susan