Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

Partners

Thales

search

Please Note:

Thales

When the Thales partner technology is used to make a decision, the result of its analysis is included in decisionDetails under an element named gemaltoRiskEngine.

Enabled rules are displayed and scores are detailed based on the rules triggered.

Important elements

The table below highlights the important elements to understand when using Thales to analyse risks.

Note: In this table, the JSON Path column represents a relative path inside the IdCloud response. Click here for the full path.

Custom tenant configuration

The list below is the latest version of our default tenant configuration. If your tenant has been customized, or is running a previous version, your setup may differ from the list below.

Direction Name JSON Path Type Description Mandatory Example
Output rulesetExternalId rulesetExternalId String Unique ID identifying the evaluated ruleset true GTO_example
Output rulename rulename String The name of the evaluated rule, only present in case of flag evaluation false isFF
Output ruleExpectedValue ruleExpectedValue Boolean The expected value of the evaluated rule, only present in case of flag evaluation false true
Output score score Integer The score of the evaluated ruleset false 0
Output result result JSON A JSON object with one key per evaluated rule and the result of the evaluation as a value. Each key is a string associated to a value in {“true”, “false’, “unknown”}. { "isFF" : "true", "mobile" : "false", "is TOR" : "false", "change country no params" : "unknown", "change country params" : "unknown" }
Output attributes attributes JSON A JSON object with all collected or computed signals.
Output deviceBrowser attributes.deviceBrowser JSON A JSON object with generic signals collected from the web browser or coming from the user agent analysis.
Output networkIp attributes.deviceBrowser.networkIp String The IP used by the device true "10.0.68.70"
Output userAgent attributes.deviceBrowser.userAgent String-512 The user agent of the browser of the device false "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0"
Output browserName attributes.deviceBrowser.browserName String The browser name of the device in {"Internet explorer", "safari", "chrome", "android browser", "edge", "firefox"} false "safari"
Output browserVersion attributes.deviceBrowser.browserVersion String The browser version false "65.0"
Output osName attributes.deviceBrowser.osName String The OS name of the device in {"windows", "windows phone", "mac os", "android", "linux", "ios"} false "ios"
Output osVersion attributes.deviceBrowser.osVersion String The OS version of the device false "7"
Output osFamily attributes.deviceBrowser.osFamily String The OS family of the device in {"OS X", "iOS", "Android", "Windows"} false "iOS"
Output osVersionOfFamily attributes.deviceBrowser.osVersionOfFamily String The OS version of the device false "7"
Output osReleaseDateOrder attributes.deviceBrowser.osReleaseDateOrder Integer The release date index in the family of OS version false 3.0
Output screenWidth attributes.deviceBrowser.screenWidth Integer The screen width in pixels false 1536.0
Output screenHeight attributes.deviceBrowser.screenHeight Integer The screen height in pixels false 864.0
Output deviceMobileApp attributes.deviceMobileApp JSON A JSON object with signals collected from the mobile application, only available in case of mobile use case. false
Output networkSettings attributes.deviceMobileApp.networkSettings JSON A JSON object with signals related to network settings false
Output name attributes.deviceMobileApp.networkSettings.signals.name String Network name in use during signal collection false "operator"
Output platformSettings attributes.deviceMobileApp.platformSettings JSON A JSON object with signals related to platform settings false
Output isLocationEnabled attributes.deviceMobileApp.platformSettings.signals.isLocationEnabled Boolean Location enabled status true/false false true
Output isBluetoothEnabled attributes.deviceMobileApp.platformSettings.signals.isBluetoothEnabled Boolean Bluetooth enabled status true/false false false
Output isWifiEnabled attributes.deviceMobileApp.platformSettings.signals.isWifiEnabled Boolean Wifi enabled status true/false false true
Output platform attributes.deviceMobileApp.platform JSON A JSON object with signals related to platform false
Output isRooted attributes.deviceMobileApp.platform.signals.isRooted Boolean True when a root/jailbreak evidence has been detected, false otherwise. false true
Output family attributes.deviceMobileApp.platform.signals.family Boolean The family of the platform false "android"
Output version attributes.deviceMobileApp.platform.signals.version Boolean The version of the platform false "7.0"
Output network attributes.deviceMobileApp.network JSON A JSON object with signals related to network false
Output type attributes.deviceMobileApp.network.signals.type String Network type in use during signal collection false "cellular"
Output hwAddress attributes.deviceMobileApp.network.signals.hwAddress String Network Mac/Hardware address. A value matching the RE ^[a-fA-F0-9:]{1,255}$ false "58:8A:6B:E2:DC:7A"
Output location attributes.deviceMobileApp.location JSON object A JSON object with signals related to location
Output latitude attributes.deviceMobileApp.location.signals.latitude Number Latitude of the device at the signal collection time false 43.206527
Output altitude attributes.deviceMobileApp.location.signals.altitude Number Height of the device at the signal collection time false 0.0
Output source attributes.deviceMobileApp.location.signals.source String The source of the signal collection {"gps", "network", "unknown"} false "gps"
Output time attributes.deviceMobileApp.location.signals.time String The time when the location is collected false "2019-02-27T19:04:42.917Z"
Output accuracy attributes.deviceMobileApp.location.signals.accuracy number Precision of the collected location false 22.402
Output longitude attributes.deviceMobileApp.location.signals.longitude number Longitude of the device at the signal collection time false 5.5964194
Output device attributes.deviceMobileApp.device JSON A JSON object with signal related to device false
Output fingerprint attributes.deviceMobileApp.device.signals.fingerprint String Device fingerprint false "2be5dace1b1112b51f4a88e64ca6de87421984241f4fa84ee8ad982455b00003"
Output manufacturer attributes.deviceMobileApp.device.signals.manufacturer String Device manufacturer, as provided by device false "samsung"
Output model attributes.deviceMobileApp.device.signals.model String Device model, as provided by device false "SM-A310F"
Output ipintelligence attributes.ipintelligence JSON A JSON object with information coming from our IP Intelligence partner, based on the collected IP, only available if an IP Intelligence condition was evaluated. false
Output country_code attributes.ipintelligence.country_code String The International Standard Organisation's two-letter code indicating the name of the country, as defined in ISO-3166. false "fr"
Output country_cf attributes.ipintelligence.country_cf Integer Country Confidence Factor. The possible values range from 0 (null) to 99. The higher the value, the greater the likelihood that the user is in the assigned country. false 99.0
Output anonymizer_status attributes.ipintelligence.anonymizer_status String Indicates whether the IP address is associated with a known anonymous proxy, and that proxy's status as measured by IP Intelligence. A value in {"private", "active", "suspect", "inactive", "unknown"} false "inactive"
Output proxy_type attributes.ipintelligence.proxy_type String Set when the network or protocol used by the server to proxy the user connection is identified. Proxy type classifications include the use of http, Tor, web and SOCKS. A value in {"service", "socks", "socks http", "tor", "unknown"} false
Output continent attributes.ipintelligence.continent String The continent in which the IP address is located. false europe
Output country attributes.ipintelligence.country String The name of the country in which the IP address is located. false france
Output region attributes.ipintelligence.region String Specifies generic or regional geographical designation that covers a larger area than state (such as northwest in the US) for some countries, and specific information (such as northern_ireland) for a few other countries. false provence-alpes-cote d'azur
Output state attributes.ipintelligence.state String IP Intelligence provides information for states and provinces (that is, the first-level administrative division) in all countries where they exist. false bouches-du-rhone
Output state_cf attributes.ipintelligence.state_cf String Because IP addresses are located with different levels of precision, IP Intelligence provides a state confidence factor that reflects a relative measure of certainty that the user is in the location identified in the state field. The possible values range from 0 (null) to 99. The higher the value, the greater the likelihood that the user is in the assigned state. false 98
Output city .attributes.ipintelligence.city String IP Intelligence locates users to their individual cites and recognises over 150,000 distinct international locations. false marseille
Output city_cf attributes.ipintelligence.city_cf String Because IP addresses are located with different levels of precision, IP Intelligence provides a city confidence factor that reflects a relative measure of certainty that the user is in the location identified in the city field. The possible values range from0 (null) to 99. The higher the value, the greater the likelihood that the user is in the assigned city. false 98
Output postal_code attributes.ipintelligence.postal_code String The postal code assigned to the corresponding city. Most postal code assignments are derived from the city field. Where we have sufficient evidence, the postal code is explicit. IP Intelligence provides postal codes for most countries. false 13001
Output time_zone attributes.ipintelligence.time_zone String Time zone is provided as a +/- offset from Greenwich Mean Time (GMT), represented as a floating point number, so that you can calculate what time it is in the location provided. Values can be between -11 and 13. false 1
Output latitude attributes.ipintelligence.latitude String The latitude of the identified location, expressed as a floating point number with a range of -90 to 90, with positive numbers representing North and negative numbers representing South. Latitude and longitude are derived from the city or postal code. false 43.29834
Output longitude attributes.ipintelligence.longitude String The longitude of the identified location, expressed as a floating point number with a range of -180 to 180, with positive numbers representing East and negative numbers representing West. Latitude and longitude are derived from the city or postal code. false 5.38322
Output connection_type attributes.ipintelligence.connection_type String Users can connect to the Internet in several different ways. IP Intelligence identifies connections by these types. one of: ocx, tx, consumer satellite, framerelay, dsl, cable, isdn, dialup, dialup, fixed wireless, mobile wireless, unknown low, unknown medium, unknown high. false ocx
Output line_speed attributes.ipintelligence.line_speed String Indicates the speed of the connection to the Internet, divided into: high, medium, or low. This information is determined by the Connection Type. false medium
Output ip_routing_type attributes.ipintelligence.ip_routing_type String The IP Routing Type (IPRT) specifies how the connection is routed through the Internet and can be used to determine how close the user is to the public IP address. false fixed
Output asn attributes.ipintelligence.asn String The Autonomous System Number (ASN) is a globally unique number assigned to a group of networks administered by a single entity such as a Network Service Provider (NSP) or very large organisation. false 12322
Output sld attributes.ipintelligence.sld String The Second-Level Domain (SLD) is the part of the domain name that precedes the top-level domain. false proxad
Output tld attributes.ipintelligence.tld String The Top-Level Domain (TLD) Identifies the most general part of the domain name in a Web address. false net
Output organization attributes.ipintelligence.organization String The Registering Organisation is the entity responsible for the actions and content associated with a given block of IP addresses. false roxad / free sas
Output carrier attributes.ipintelligence.carrier String Provides the name of the organisation that owns the ASN. false free sas
Output hosting_facility attributes.ipintelligence.hosting_facility Boolean The hosting facility field is a quick determination of whether the connection originated at a facility that provides storage, computing or telecommunication services. false false
Output ip_address attributes.ipintelligence.ip_address String The referenced IP address used as origin of the connection false 82.224.174.127

Flags

Thales returns flags that provide information about the evaluation that was done. Below is the list of the most important ones.

Note: In this table, the JSON Path column represents a relative path inside the IdCloud response. Click here for the full path.

Direction Name JSON Path Type Description Mandatory Example
Output browser android result.browser android Boolean Browser is android browser false false
Output browser chrome result.browser chrome Boolean Browser is chrome false false
Output browser edge result.browser edge Boolean Browser is edge false true
Output browser firefox result.browser firefox Boolean Browser is firefox false false
Output browser ie result.browser ie Boolean Browser is internet explorer false true
Output browser opera result.browser opera Boolean Browser is opera false false
Output browser safari result.browser safari Boolean Browser is safari false true
Output continent africa result.continent africa Boolean Country is in [DZ AO BJ BW BF BI CM CV CF TD KM CD DJ EG GQ ER ET GA GM GH GN GW CI KE LS LR LY MG MW ML MR MU YT MA MZ NA NE NG CG RE RW SH ST SN SC SL SO ZA SS SD SZ TZ TG TN UG EH ZM ZW] false false
Output continent antartica result.continent antartica Boolean Country is in [AQ] false true
Output continent asia result.continent asia Boolean Country is in [AF AM AZ BH BD BT IO BN KH CN CX CC GE HK IN ID IR IQ IL JP JO KZ KW KG LA LB MO MY MV MN MM NP KP OM PK PS PH QA SA SG KR LK SY TW TJ TH TR TM AE UZ VN YE] false true
Output continent europe result.continent europe Boolean Country is in [AL AD AT BY BE BA BG HR CY CZ DK EE FO FI FR DE GI GR GG HU IS IE IM IT JE XK LV LI LT LU MK MT MD MC ME NL NO PL PT RO RU SM RS SK SI ES SJ SE CH UA GB VA] false true
Output continent north america result.continent north america Boolean Country is in [AI AG AW BS BB BZ BM VG CA KY CR CU CW DM DO SV GL GD GT HT HN JM MX MS AN NI PA PR BL KN LC MF PM VC SX TT TC VI US] false false
Output continent oceania result.continent oceania Boolean Country is in [AS AU CK TL FJ PF GU KI MH FM NR NC NZ NU MP PW PG PN WS SB TK TO TV VU WF] false true
Output continent south america result.continent south america Boolean Country is in [AR BO BR CL CO EC FK GY PY PE SR UY VE] false false
Output country blacklist result.country blacklist Boolean Country is in [KP] false false
Output country border result.country border Boolean Country is in [BE DE] false true
Output country changed result.country changed Boolean Country changed false false
Output country changed 12hour result.country changed 12hour Boolean Country changed in the last 12hours false true
Output country changed 1day result.country changed 1day Boolean Country changed in the last 1days false false
Output country changed 1hour result.country changed 1hour Boolean Country changed in the last 1hours false true
Output country changed 1month result.country changed 1month Boolean Country changed in the last 1months false false
Output country changed 1week result.country changed 1week Boolean Country changed in the last 1weeks false true
Output country changed 6hour result.country changed 6hour Boolean Country changed in the last 6hours false false
Output country home result.country home Boolean Country is in [FR] false false
Output device new result.device new Boolean first time used device false false
Output device recurring 1day 10x result.device recurring 1day 10x Boolean Device has been authenticated a least 10 time in the last 1440min false false
Output device recurring 1day 1x result.device recurring 1day 1x Boolean Device has been authenticated a least 1 time in the last 1440min false false
Output device recurring 1day 2x result.device recurring 1day 2x Boolean Device has been authenticated a least 2 time in the last 1440min false true
Output device recurring 1day 3x result.device recurring 1day 3x Boolean Device has been authenticated a least 3 time in the last 1440min false false
Output device recurring 1day 5x result.device recurring 1day 5x Boolean Device has been authenticated a least 5 time in the last 1440min false true
Output device recurring 1hour 10x result.device recurring 1hour 10x Boolean Device has been authenticated a least 10 time in the last 60min false true
Output device recurring 1hour 1x result.device recurring 1hour 1x Boolean Device has been authenticated a least 1 time in the last 60min false true
Output device recurring 1hour 2x result.device recurring 1hour 2x Boolean Device has been authenticated a least 2 time in the last 60min false false
Output device recurring 1hour 3x result.device recurring 1hour 3x Boolean Device has been authenticated a least 3 time in the last 60min false true
Output device recurring 1hour 5x result.device recurring 1hour 5x Boolean Device has been authenticated a least 5 time in the last 60min false false
Output device recurring 1month 10x result.device recurring 1month 10x Boolean Device has been authenticated a least 10 time in the last 43800min false false
Output device recurring 1month 1x result.device recurring 1month 1x Boolean Device has been authenticated a least 1 time in the last 43800min false false
Output device recurring 1month 2x result.device recurring 1month 2x Boolean Device has been authenticated a least 2 time in the last 43800min false true
Output device recurring 1month 3x result.device recurring 1month 3x Boolean Device has been authenticated a least 3 time in the last 43800min false false
Output device recurring 1month 5x result.device recurring 1month 5x Boolean Device has been authenticated a least 5 time in the last 43800min false true
Output device recurring 1week 10x result.device recurring 1week 10x Boolean Device has been authenticated a least 10 time in the last 10080min false true
Output device recurring 1week 1x result.device recurring 1week 1x Boolean Device has been authenticated a least 1 time in the last 10080min false true
Output device recurring 1week 2x result.device recurring 1week 2x Boolean Device has been authenticated a least 2 time in the last 10080min false false
Output device recurring 1week 3x result.device recurring 1week 3x Boolean Device has been authenticated a least 3 time in the last 10080min false true
Output device recurring 1week 5x result.device recurring 1week 5x Boolean Device has been authenticated a least 5 time in the last 10080min false false
Output device recurring 6month 10x result.device recurring 6month 10x Boolean Device has been authenticated a least 10 time in the last 262800min false true
Output device recurring 6month 1x result.device recurring 6month 1x Boolean Device has been authenticated a least 1 time in the last 262800min false true
Output device recurring 6month 2x result.device recurring 6month 2x Boolean Device has been authenticated a least 2 time in the last 262800min false false
Output device recurring 6month 3x result.device recurring 6month 3x Boolean Device has been authenticated a least 3 time in the last 262800min false true
Output device recurring 6month 5x result.device recurring 6month 5x Boolean Device has been authenticated a least 5 time in the last 262800min false false
Output device rooted result.device rooted Boolean Device is rooted false true
Output ip address is private result.ip address is private Boolean IP address is in list 'private' false true
Output ip address is public result.ip address is public Boolean IP address is in list 'public' false false
Output ip address is reserved result.ip address is reserved Boolean IP address is in list 'reserved' false false
Output network anonymous result.network anonymous Boolean Network is using VPN false true
Output network tor result.network tor Boolean Network is using TOR false false
Output os android result.os android Boolean Operating System is android false false
Output os ios result.os ios Boolean Operating System is ios false true
Output os linux result.os linux Boolean Operating System is linux false true
Output os mac result.os mac Boolean Operating System is mac os false false
Output os windows result.os windows Boolean Operating System is windows false true
Output region eu6 result.region eu6 Boolean Country is in [BE FR DE IT LU NL] false false
Output screen resolution cga+ result.screen resolution cga+ Boolean Screen resolution is using >320x200px false true
Output screen resolution hd+ result.screen resolution hd+ Boolean Screen resolution is using >1280x720px false false
Output screen resolution svga+ result.screen resolution svga+ Boolean Screen resolution is using >800x600px false true
Output true result.true Boolean IP address is not in list 'empty' false true

Examples

Below are two examples of Thales responses:

  • gemaltoRiskEngine for browser presents the result for a transaction issued via a browser.
  • gemaltoRiskEngine for mobile presents the result for a transaction issued via a mobile application.
{
  "status": "SUCCESS",
  "decision": {
      "access": "allowed",
      "auth": [{"type": "password"}]
  },
  "policy": {
      "name": "Login",
      "id": "f7a20736-2d7a-440a-b17e-d2c80b1f7531",
      "scenario": {
          "name": "Fraud protection with GTO ruleset",
          "id": "67425ff5-717b-6c3e-9ebf-f0ee119e5ba1"
      }
  },
  "getDecisionDetails": {
      "gemaltoRiskEngine": [
          {
              "rulesetExternalId": "GTO_example",
              "rulename": "isFF",
              "ruleExpectedValue": true,
              "score": 0,
              "result": {
                  "isFF": "true",
                  "mobile": "false",
                  "is TOR": "false",
                  "change country no params": "unknown",
                  "change country params": "unknown"
              },
              "attributes": {
                  "deviceBrowser": {
                      "networkIp": "10.0.68.70",
                      "userAgent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0",
                      "browserName": "firefox",
                      "browserVersion": "65.0",
                      "osName": "windows",
                      "osVersion": "7",
                      "osFamily": "Windows",
                      "osVersionOfFamily": "7",
                      "osReleaseDateOrder": 3,
                      "screenWidth": 1536,
                      "screenHeight": 864
                  },
                  "ipintelligence": {
                      "continent": "europe",
                      "country": "france",
                      "country_code": "fr",
                      "country_cf": 99,
                      "region": "ile-de-france",
                      "state": "seine-saint-denis",
                      "state_cf": "80",
                      "city": "la plaine-saint-denis",
                      "city_cf": "61",
                      "postal_code": "93534",
                      "time_zone": "1",
                      "latitude": "48.9085",
                      "longitude": "2.3638",
                      "connection_type": "tx",
                      "line_speed": "high",
                      "ip_routing_type": "fixed",
                      "asn": "62044",
                      "organization": "zscaler  inc.",
                      "carrier": "zscaler switzerland gmbh",
                      "hosting_facility": "true",
                      "ip_address": "123.123.12.12"
                   }
              }
          }
      ]
  }
}

{
  "status": "SUCCESS",
  "decision": { "access": "allowed", "auth": [ { "type": "password"  } ] },
  "policy": {
    "id": "06542321-c45e-f65c-eca65646545654f67",
    "name": "mobile login",
    "scenario": {
      "id": " 0011c00d-b48b-b82c-4a66-1d394b64ff67",
      "name": "Fraud Protection with Gemalto Ruleset"
    }
   },
   "getDecisionDetails":{
     "gemaltoRiskEngine" :{
           "rulesetExternalId":"myRuleset",
           "rulename":"myRuleName",
           "ruleExpectedValue": "myRuleExpectedValue",
           "score": 0,
           "result": {
                 "myRuleOne":"myRuleOneResult",
                 "myRuleTwo":"myRuleTwoResult",
                     …..
                 "myRuleN":"myRuleNResult"
            },
           "attributes": {
            "deviceBrowser": {
              "networkIp": "37.170.83.32",
              "userAgent": "Mozilla\/5.0 (Linux; Android 7.0; SM-A310F Build\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/72.0.3626.105 Mobile Safari\/537.36",
              "browserName": "chrome webview",
              "browserVersion": "72.0.3626.105",
              "osName": "android",
              "osVersion": "7.0",
              "osFamily": "Android",
              "osVersionOfFamily": "7.0",
              "osReleaseDateOrder": 4,
              "isRooted": false,
              "threatmetrix": "94000194790fdc261cc01a7c7e75f7d9"
            },
            "deviceMobileApp": {
              "networkSettings": {
                "signals": {
                  "name": "operator"
                }
              },
              "platformSettings": {
                "signals": {
                  "isLocationEnabled": true,
                  "isBluetoothEnabled": false,
                  "isWifiEnabled": true
                }
              },
              "platform": {
                "signals": {
                  "isRooted": false,
                  "family": "android",
                  "version": "7.0"
                }
              },
              "network": {
                "signals": {
                  "type": "Cellular",
                  "hwAddress": "58:8A:6B:E2:DC:7A"
                }
              },
              "location": {
                "signals": {
                  "latitude": 43.206527,
                  "altitude": 0,
                  "source": "network",
                  "time": "2019-02-27T19:04:42.917Z",
                  "accuracy": 22.402,
                  "longitude": 5.5964194
                }
              },
              "device": {
                "signals": {
                  "fingerprint": "2be5dace1b1112b51f4a88e64ca6de87421984241f4fa84ee8ad982455b00003",
                  "manufacturer": "samsung",
                  "model": "SM-A310F"
                }
              }
            }
          }
        }
      ]
    }
  }
}

JSON relative paths

In the tables on this page, the JSON path column contains relative JSON paths.

For easier readability, we have removed the beginning of the JSON path since it is common to all paths. This part is shown below.

You can also check the example section to see a complete response.

{
  "state": {
    "result": {
      "object": {
        "risk": {
          "decisionDetails": {
            "gemaltoRiskEngine":
                "JSON RELATIVE PATH"
              }
            }
      }
    }
  }
}

On this page