Default rules

This page documents the Default rules available in the Risk Management Essential edition.

Device profiling

• Detect usual device: Checks whether the device was used by the user at least value times over the last value hours | days | weeks | months.

• Detect usual device with authentication method: Checks whether the device was used by the user at least value times over the last value hours | days | weeks | months with a specific authentication method.

• Detect first time used device: Checks whether the device was used for the first time.

User behavior analysis

• Check the number of failed user authentications: Checks whether the user failed to authenticate at least value times over the last value hours | days | weeks | months.

• Check the number of successful user authentications: Checks whether the user authenticated successfully at least value times over the last value hours | days | weeks | months.

• Check the number of consecutive failed user authentications: Checks whether the user consecutively failed to authenticate at least value times.

• Detect first time user: Checks whether this is the first visit for a specific user.

Device

• Browser and version:

  • Browser name is one of:

    • Firefox
    • Internet Explorer
    • Chrome
    • Edge
    • Opera
    • Safari
    • Android browser

  • Version comparison: < value or > value

• OS name:

  • OS name is one of:

    • Windows
    • Android
    • iOS
    • macOS
    • Linux
    • Windows mobile

• Screen size

  • Width: value
  • Height: value

Geolocation

• Detect change of country: Checks whether the user is connecting from a different country than the previous successful authentication.

  • Options:

    • Lookback window: over the last value hours | days | weeks | months

    • Include anonymous IP (check box)

• Check country of connection: Checks whether the connection country is included or excluded from a country list (multi-select with search).

  -Option: Include anonymous IP (check box)

IP intelligence

• Check connection IP address: Checks whether the connection IP is included or excluded.

• Check anonymized IP address: Detects whether the IP address is anonymized:

  • By any method
  • By TOR node
  • Detect if IP address is not anonymized