SAS Visual Investigator and Scenario Administration
SAS Visual Investigator now has a component called Scenario Administrator. Scenario Administrator provides fraud detection authoring and surveillance capabilities to the SAS Visual Investigator product. Scenario Administrator is a data-driven tool, designed to allow users to explore their data and author surveillance strategies and decision flows to generate Alerts with the SAS Visual Investigator interface.
The illustration below from the SAS Visual Investigator 10.2: Using the Scenario Administrator guide depicts the Scenario Administrator Process. In this article, the steps that are performed within the Scenario Administrator user interface (steps 1 – 5) are reviewed. Step 6 which is performed in the SAS Visual Investigator user interface will be discussed in a future article.
1. Create Flow
When you create a flow, select one or more data sources. Only external and internal entity sources can be selected. Children entities and data setup as Transactions cannot be selected. The Scenario Administrator uses this data during the scenario design, test, and flow run process.
The screenshot above depicts that the data source for the scenario flow is the customer table.
- Design Scenarios and Scorecards
Design a scenario by completing the necessary configuration information and assigning rule(s) to trigger an alert. There are three types of scenarios you can design:
- Record-level Scenario – allows you to surveil data by individual records in the dataset. The output is all records in the dataset.
- Grouping Scenario – allows you to surveil data at an aggregated level for one or more columns in the data. The output is one row per unique grouping.
- DATA Step Scenario – allows to you use SAS DATA Step code to design your scenarios thus offering you more flexibility than is offered by the user interface. The output is dependent on the code.
The screenshot above depicts a grouping scenario that looks for households with more than one address for its customer records by:
(A) grouping the customer records by their household number
(B) creating and address_cnt column that aggregates the customer records by address
(C) triggering the scenario if the address_cnt is greater than 1.
- Test Scenarios
Run a test of the scenario against the assigned data. This enables you to verify the effectiveness of the scenario configuration.
- Review Results
Review the scenario test results and examine its associated statistical information. If necessary, fine-tune the scenario by modifying its configuration settings. For example, you may want to modify the rule(s) that trigger the alert.
The screenshot above depicts the test results for the households with different address grouping scenario. The results show that 42 of 627 households had different addresses at the time this test was performed.
If necessary, repeat steps 2 through 4 to create additional scenarios for your flow. You can also create a scorecard, which performs further processing on the event triggers that are generated by the scenarios within the flow. Creating a scorecard provides you the flexibility to only create alerts for data that meets a certain a threshold (score).
The screenshot above depicts a scorecard for a Scenario Administrator flow. This scorecard is based on two scenarios and its score is based on the sum of the score from those two scenarios. When this flow is executed, if that score is greater than or equal to 100, then an alert will be triggered and displayed in SAS Visual Investigator.
- Publish and Run Completed Flow
Publish and run the flow to trigger alerts in SAS Visual Investigator application. A flow must be published and have the status of Available in order to be executed. Published flows can also be versioned. In addition, publishing a flow gives you a URL to run the flow outside of the SAS Scenario Administrator.
- Investigate, Disposition, and Triage Generated Alerts
When the flow run is complete, you can perform further review and analysis of the alerts generated in SAS Visual Investigator. For more information, refer to the Understanding Alerts section in SAS Visual Investigator: User’s Guide. This topic will be covered in a future article.
This article covered how to create Alerts in SAS Visual Investigator using Scenario Administrator, refer to this article by Bobbie Wagoner on how to create alerts manually in SAS Visual Investigator. For more information on Scenarion Administration refer to the SAS Visual Investigator 10.2: Using the Scenario Administrator guide. Note: The SAS Visual Investigator documentation requires an access key, if you do not already have one, contact SAS Technical Support.
