Configure detection rules and thresholds
Detection rules evaluate incoming records, or groups of records, against configurable thresholds. This topic describes how to activate a rule and tune its thresholds.
Activate or deactivate a detection rule
- Open the Detection Rules page in the Contoso Admin Console.
- Locate the rule, such as
RapidMovementOfFunds. - Toggle the Active switch to enable or disable the rule.
- Save your change.
Threshold types
The Contoso Platform supports two general categories of thresholds:
| Threshold type | Description |
|---|---|
| Individual threshold | Applied to a single entity, such as one account or one customer. |
| Population threshold | Applied relative to a peer group, such as the average behavior of similar customers. |
Configure an individual threshold
- Open the detection rule and select the Individual Thresholds tab.
- Set the threshold value, such as a maximum number of transactions per day.
- Optionally, define a different threshold for each customer segment using user-defined values. See Configure business logic.
Configure a population threshold
- Open the detection rule and select the Population Thresholds tab.
- Choose the peer group definition to compare against, such as
CustomerSegment + Country. - Set the deviation threshold as a multiple of the peer group’s average activity, such as 3 times the average.
Example rule configuration
| Rule name | Threshold type | Example threshold |
|---|---|---|
RapidMovementOfFunds |
Individual | More than 5 outbound transfers within 24 hours. |
UnusualCashActivity |
Population | Cash deposits exceeding 3 times the peer group average over 30 days. |
StructuringPattern |
Individual | 3 or more deposits just below a defined reporting threshold within 7 days. |
Note: The rule names and threshold values above are illustrative examples only. They don’t represent any real detection methodology and shouldn’t be used as the basis for an actual compliance program.
| ← Previous: Configure business logic | Next: Configure scoring → |