Please Note:

ThreatMetrix

When the ThreatMetrix partner technology is used to make a decision, the result of its analysis is included in decisionDetails under an element named threatmetrix.

The full documentation can be found on the ThreatMetrix website: https://portal.threatmetrix.eu/kb

Multiple policies

If several ThreatMetrix policies were used in the decision, the details of each one are included in the threatmetrix element JSON object.

threatmetrix: [
    {"policyName": "Standard policy", policy details...} ,
    {"policyName": "Advance policy", policy details...} ,
    {…}
]

Important elements

The table below highlights the important elements to understand when using ThreatMetrix to analyse risks.

You can also find more detailed information on the parameters and data formats on the ThreatMetrix web site: https://portal.threatmetrix.eu/kb

Note: In the table below, the JSON Path column represents a relative path inside the IdCloud response. Click here for the full path.

Table of important elements

Direction	Name	JSON Path	Type	Description	Mandatory	Example
Output	Account Address Local Trust Tags	account_address_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Account Address Global Trust Tags	account_address_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_LOGIN_FAILED
Input, Output	Account Address City	account_address_city	string	The city associated with this account address.	false	San Jose
Input, Output	Account Address Country	account_address_country	string	The country associated with this account address indicated by the 2 character ISO2 country code of the account address country: http://www.iso.org/iso/country_codes. If the API call includes the country, then ThreatMetrix's policy engine will try and locate a latitude and longitude value for the country. If the country cannot be located in the database, then the following reason code is returned: Account_Address_Geolocation_country_not_found	false	US
Output	Account Address First Seen	account_address_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-04-07
Output	Account Address Last Event	account_address_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-04-07
Output	Account Address Last Update	account_address_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-04-07
Output	Account Address Result	account_address_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Account Address Score	account_address_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false	0
Output	Account Address Last Assertion	account_address_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format. DEPRECATED	false	2017-04-07
Output	Account Address Assertion History	account_address_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	NEGATIVE_HISTORY
Input, Output	Account Address State	account_address_state	string	The state component of the account address.	false	CA
Input, Output	Account Address Street 1	account_address_street1	string	The first line of the street address for this account address.	false	13 Threatmetrix street
Input, Output	Account Address Street 2	account_address_street2	string	The second line of the street address for this account address.	false	Chatswood
Output	Account Address Worst Score	account_address_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-11
Input, Output	Account Address Postal Code	account_address_zip	string	The zip/postal code of this account address. If the API call includes the zip code, then ThreatMetrix's policy engine will try and locate a latitude and longitude value for the zip code. If the country or the zip code cannot be located in the database, then the following reason code is returned: Account_Address_Geolocation_zip_not_found	false	94138
Input, Output	Account Email	account_email	string	The email address entered associated with this event.	false	bsmith@example.com
Output	Account Email Local Trust Tags	account_email_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_TRUSTED_CONF
Output	Account Email Global Trust Tags	account_email_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_TRUSTED_CONF
Output	Account Email First Seen	account_email_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-10
Output	Account Email Last Event	account_email_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-10
Output	Account Email Last Update	account_email_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-10
Output	Account Email Result	account_email_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Account Email Score	account_email_score	integer	The risk score between +100 (low to minimum risk) and -100 (high to maximum risk)	false	0
Output	Account Email Assertion History	account_email_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	CONFIRMED_GOOD
Output	Account Email Last Assertion	account_email_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-08-10
Output	Account Email Worst Score	account_email_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-6
Input, Output	Account First Name	account_first_name	string	The first name of the account holder (if no account_name is provided, this is used in conjunction with the Account Last Name to provide a concatenated value for Account Name. This is not used if Account Name is already provided or Account Last Name is not also provided.)	false	Bob
Input, Output	Account Last Name	account_last_name	string	The last name of the account holder (if no account_name is provided, this is used in conjunction with the Account First Name to provide a concatenated value for Account Name. This is not used if Account Name is already provided or Account First Name is not also provided.)	false	Smith
Input, Output	Account Login	account_login	string	This is a unique customer identifier e.g. username, account id, or login name.	false	bsmith
Output	Account Login Local Trust Tags	account_login_activities	unlimited	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_WATCH
Output	Account Login Global Trust Tags	account_login_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_WATCH
Output	Account Login First Seen	account_login_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-10
Output	Account Login Last Event	account_login_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-10
Output	Account Login Last Update	account_login_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-10
Output	Account Login Result	account_login_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Account Login Score	account_login_score	integer	The risk score between +100 (low to minimum risk) and -100 (high to maximum risk).	false	5
Output	Account Login Worst Score	account_login_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-12
Output	Account Login Assertion History	account_login_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	NEGATIVE_HISTORY
Output	Account Login Last Assertion	account_login_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2013-11-19
Input, Output	Account Name	account_name	string	The concatenated Account First Name and Account Last Name or account identifier	false	BOB_SMITH
Output	Account Name Local Trust Tags	account_name_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Account Name Global Trust Tags	account_name_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_LOGIN_FAILED
Output	Account Name First Seen	account_name_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2016-12-29
Output	Account Name Last Event	account_name_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-08
Output	Account Name Last Update	account_name_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-08
Output	Account Name Result	account_name_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Account Name Score	account_name_score	integer	The risk score between +100 (good) and -100 (bad)	false	0
Output	Account Name Worst Score	account_name_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-35
Output	Account Name Assertion History	account_name_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	NEGATIVE_HISTORY
Output	Account Name Last Assertion	account_name_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2013-11-19
Input, Output	Account Number	account_number	string	The account number supports an alphanumeric format 0-9/a-z/A-Z. Please note that '-' is not supported and whitespaces and special characters are stripped out.	false
Output	Account Number Local Trust Tags	account_number_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Account Number Global Trust Tags	account_number_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_LOGIN_FAILED _THREAT _WATCH
Output	Account Number First Seen	account_number_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2013-11-19
Input, Output	ACH Account Hash	ach_account_hash	string	The hashing must be performed by the customer performing the API call. Recommeded is SHA-256 hash (in hexadecimal format) of the Account Number. Accepted currently: SHA-1 (40 bytes) SHA-224 (56 bytes), SHA-256 (64 bytes), SHA-384 (96 bytes), SHA-512 (128 bytes)	false	SHA-256 using the following characters "0123456789abcdefABCDEF"
Output	Account Number Last Event	account_number_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-08
Output	Account Number Last Update	account_number_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-08
Output	Account Number Result	account_number_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Account Number Score	account_number_score	integer	Risk score between +100 (low to minimum risk) and -100 (high to maximum risk) for the account number.	false	-100 to +100
Output	Account Number Worst Score	account_number_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-100 to 0
Output	Account Number Assertion History	account_number_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_NEGATIVE_HISTORY
Output	Account Number Last Assertion	account_number_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-08-08
Input, Output	Account Telephone	account_telephone	string	Contact telephone number including country and city codes. All whitespace is removed. Must be numeric 0...9 with only these acceptable punctuation characters: period, comma, semicolon, parentheses and braces . , ,(,),, Parentheses and braces must be matched.	false
Output	Account Telephone Local Trust Tags	account_telephone_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Account Telephone Global Trust Tags	account_telephone_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_LOGIN_FAILED _THREAT _WATCH
Output	Account Telephone First Seen	account_telephone_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Account Telephone Last Event	account_telephone_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-08
Output	Account Telephone Last Update	account_telephone_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2013-11-19
Output	Account Telephone Result	account_telephone_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Account Telephone Score	account_telephone_score	integer	The risk score between +100 (low to minimum risk) and -100 (high to maximum risk).	false	-100 to +100
Output	Account Telephone Worst Score	account_telephone_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-100 to 0
Output	Account Telephone Assertion History	account_telephone_assert_history	string	The assertion history for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	CONFIRMED_BAD
Output	Account Telephone Last Assertion	account_telephone_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2013-11-19
Output	ACH Number	ach_number	string	This field is a combination of ach_routing_number and ach_account_hash, returned as an output.	false	577963861081_5601f922cd522ed759e8befe9936402c0799865c
Output	ACH Number Local Trust Tags	ach_number_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	ACH Number Global Trust Tags	ach_number_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	"_LOGIN_FAILED _THREAT _WATCH"
Output	ACH Number First Seen	ach_number_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2013-11-19
Output	ACH Number Last Event	ach_number_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-08
Output	ACH Number Last Update	ach_number_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-08
Output	ACH Number Result	ach_number_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	ACH Number Score	ach_number_score	integer	The risk score between +100 (low to minimum risk) and -100 (high to maximum risk).	false	-100 to +100
Output	ACH Number Worst Score	ach_number_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-100 to 0
Output	ACH Number Assertion History	ach_number_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	CONFIRMED_BAD
Output	ACH Number Last Assertion	ach_number_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-08-08
Input, Output	ACH Routing Number	ach_routing_number	string	The routing number for the account. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false	567963861081
Input, Output	API Action	action	string	The action performed by the TrustDefender for querying and updating Lists /Trust Tags and Review Status using the new TrustDefender APIs.	false	check_review_status, check_trust_tag, check_black_list, check_white_list, check_watch_list, update_review_status, set_trust_tag, add_black_list, add_white_list, add_watch_list, remove_trust_tag, remove_black_list, remove_white_list, remove_watch_list, do_challenge, do_verify_challenge
Output	Agent Name	agent_name	string	Hash (SHA1) of the device name. TD Mobile iOS: This is the name of the device. Depending on user configuration, this can sometimes contain the person's name. E.G: John's iPhone. TD Mobile Android: Not populated TD Client Windows: Hostname of the device TD Client OS X: Hostname of the device	false	John's Phone
Output	Device Brand	agent_brand	string	In Android: the consumer-visible brand with which the product/hardware will be associated, In iOS: this will be 'Apple'.	false	iOS: Apple, Android: HTC, Samsung etc.
Output	Agent Cell ID	agent_cell_id	string	The Cell ID of the Cellular Base Station the device is connected to during profiling.	false
Output	Agent Device ID	agent_device_id	string	In TrustDefender Mobile: a hash of various device attributes that are unlikely to change. This value may be duplicated on different devices and should not be used for unique identification. Use the Exact ID Instead. In TrustDefender Client: A unique, device based identifier generated when TrustDefender Client is installed. This value will not be dupliated and can be used for the purposes of device identification.	false	6a340affb04e4c3a97754828d6c6b550
Output	Agent Device State	agent_device_state	string	A hash of various device attributes that represents its current state, good for short term identification only. It is not recommended to use this value for unique device identification. Use the Exact ID instead.	false	2a64502f1fa5efb1114c297d21f20b1d
Output	Device Language	agent_language	string	The Language code of the language in use by the operating system. In Android: Locale.getDefault().getLanguage() In iOS: [[NSLocale preferredLanguages] objectAtIndex:0]	false	For example: EN_US
Output	Device Locale	agent_locale	string	The locale identifier	false	For example: EN_US
Output	Agent Model	agent_model	string	In iOS, the model identifier, as defined by Apple. In Android, this could vary based on the model defined in Build.MODEL for the device.	false	iPhone6,2/pixel
Output	Agent OS	agent_os	string	In TrustDefender Mobile: The Operating System of the device In TrustDefender Client: The Operating System, Service Pack and processor architecture of the connecting device.	false	iOS, Android
Output	Device OS Version	agent_os_version	string	The version of the Operating System.	false	6.2
Output	Agent Type	agent_type	string	This indicates the type of device that was profiled, including mobile app, desktop app, or web browser on a desktop or mobile platform. In instances where TrustDefender Client and TrustDefender cloud is present during profiling, this attribute will contain multiple, comma separated values. In most circumstances only one value will be present. browser_mobile = Web browser on a mobile device profiled with TrustDefender Cloud. agent_mobile = Native Mobile Appprofiled with TrustDefender Mobile SDK for Android or iOS. See the OS attribute for OS information. agent_computer = Computer running TrustDefender Client (if only this value is present then TrustDefender Cloud profiling was not performed). agent_sdk = Computer running an application containing TrustDefender SDK for Windows or OS X. See the OS attribute for OS information. agent_computer, browser_computer = Computer running TrustDefender Client and TrustDefender Cloud profiling was also performed. browser_computer = Computer via a web browser that was profiled with TrustDefender Cloud.	false	browser_computer, browser_mobile, agent_computer, agent_mobile, agent_sdk
Output	Agent Version	agent_version	string	The version of the agent running on the device. Eg: v3.4.123 for TrustDefender Client on a PC/Mac, or v2.0 for TrustDefender Mobile on a mobile device. This compliments the agent_type attribute.	false	3.4.123, 2.0
Output	Agent WPS Latitude	agent_wps_latitude	float	The Latitude of the WiFi connection based on BSSID.	false	52.07806
Output	Agent WPS Longitude	agent_wps_longitude	float	The Longitude of the WiFi connection based on BSSID.	false	-0.73028
Output	Agent WPS Accuracy	agent_wps_accuracy	integer	The accuracy of the estimated location, in meters. This represents the radius of a circle around the given location.	false	200
Output	Agent Signal Strength	agent_signal_strength	integer	The Radio or WiFi signal strength measured in dBm.	false	-45
Output	Agent App Info	agent_app_info	string	The Host Application Name, version and running binary architecture (i.e. cpu type/subtype). Example: com.threatmetrix.example.app2:1.0:1:arm64The	false
Input, Output	API Type	api_type	string	The API Method which may be one of the following: Session-query, attribute-query, attribute-assertion, query, update	false	Session-query, attribute-query, attribute-assertion, query, update, 3DS
Output	Benign Installed Apps	apprep_installed_benign	string	The CSV of lowercase hex encoded hashes of installed apps that are Benign.	false
Output	Malicious Installed Apps	apprep_installed_malicious	string	The CSV of lowercase hex encoded hashes of installed apps that are Malicious.	false
Output	Moderate Installed Apps	apprep_installed_moderate	string	The CSV of lowercase hex encoded hashes of installed apps that are Moderate.	false
Output	Suspicious Installed Apps	apprep_installed_suspicious	string	The CSV of lowercase hex encoded hashes of installed apps that are Suspicious.	false
Output	Unknown Installed Apps	apprep_installed_unknown	string	The CSV of lowercase hex encoded hashes of installed apps that are unknown.	false
Output	Unwanted Installed Apps	apprep_installed_unwanted	string	The CSV of lowercase hex encoded hashes of installed apps that are Unwanted.	false
Output	Benign Running Apps	apprep_running_benign	string	The CSV of lowercase hex encoded hashes of running apps that are Benign.	false
Output	Malicious Running Apps	apprep_running_malicious	string	The CSV of lowercase hex encoded hashes of running apps that are Malicious.	false
Output	Moderate Running Apps	apprep_running_moderate	string	The CSV of lowercase hex encoded hashes of running apps that are Moderate.	false
Output	Suspicious Running Apps	apprep_running_suspicious	string	The CSV of lowercase hex encoded hashes of running apps that are Suspicious.	false
Output	Unknown Running Apps	apprep_running_unknown	string	The CSV of lowercase hex encoded hashes of running apps that are unknown.	false
Output	Unwanted Running Apps	apprep_running_unwanted	string	The CSV of lowercase hex encoded hashes of running apps that are Unwanted.	false
Output	Running App Count	apprep_runningapps	integer	The number of running apps on the mobile device at the time of profiling.	false
Output	Application Hash	apprep_selfhash	string	The lowercase hex encoded md5 hash of the mobile application that is using the SDK.	false
Output	Reputation Category	apprep_selfhash_category	string	The categorization of the self hash, which may be one of the following: "malicious","unwanted","suspicious","moderate","benign","trustworthy"	false	BENIGN
Output	Browser Language	browser_language	string	The code for the language that the browser is configured to accept which comes from the HTTP header. Codes and their meaning may be found here: http://4umi.com/web/html/languagecodes.php	false	en-US,en;q=0.5
Output	Browser Language Anomaly	browser_language_anomaly	string	Indicates as "Yes" there is an anomaly between the browser_language and flash_lang. This happens when both appear, and none of the browser's preferred languages is the same as the flash_lang.	false	Yes/Null
Output	Browser String	browser_string	string	The user agent / browser string presented in the HTTP header.	false	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:54.0) Gecko/20100101 Firefox/54.0
Output	Browser String Anomaly	browser_string_anomaly	string	Indicates as "Yes"if there is an anomaly in the browser string content.	false	Yes/Null
Output	Browser String Hash	browser_string_hash	string	An MD5 hash of the user agent / browser string.	false	99f372b446f72ab7e2ef37cc24163d53
Output	Browser String Mismatch	browser_string_mismatch	string	Indicates if there is a mismatch between the javascript user agent string and the HTTP user agent string.	false	Yes/No
Output	Browser Version	browser_version	string	The version of the browser installed. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false	54
Output	Carrier ID	carrier_id	string	A persistent identifier across native mobile apps and mobile web browsers provided by a Third Party which identifies the connection.	false	e2950be04a94513876782595133748f
Output	Carrier ID Local Trust Tags	carrier_id_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Carrier ID Global Trust Tags	carrier_id_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_LOGIN_FAILED
Output	Carrier ID First Seen	carrier_id_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2013-11-19
Output	Carrier ID Last Event	carrier_id_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-08
Output	Carrier ID Last Update	carrier_id_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-08
Output	Carrier ID Match Result	carrier_id_match_result	string	agent	false	success
Output	Carrier ID Result	carrier_id_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success
Output	Carrier ID Assertion History	carrier_id_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	NEGATIVE_HISTORY
Output	Carrier ID Last Assertion	carrier_id_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2013-11-19
Output	Carrier ID Score	carrier_id_score	integer	The risk score between +100 (low to minimum risk) and -100 (high to maximum risk) for this entity.	false	0
Output	Carrier ID Worst Score	carrier_id_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-25
Input, Output	Credit Card BIN	cc_bin_number	integer	The first 6 digits of the credit card, also known as the BIN number	false	112233
Output	Credit Card Bin Brand	cc_bin_number_brand	string	The credit card brand (e.g. AMERICAN EXPRESS, VISA, MASTERCARD etc)	false	512105
Output	Credit Card Bin Category	cc_bin_number_category	string	Category of Card (e.g. PREPAID, PLATINUM, OPTIMA etc)	false	PLATINUM
Output	Credit Card BIN Geo	cc_bin_number_geo	string	The country of the provider of the credit card (If the cc_bin_number is supplied and the provider is known).The 2 character ISO2 country code of the account address country: http://www.iso.org/iso/country_codes	false	US
Output	Credit Card BIN Issuing Organization	cc_bin_number_org	string	The Issuing Organization (e.g. BANK OF NEW JERSEY, BARCLAYS, CITIBANK, COMMONWEALTH BANK etc)	false	CITIBANK
Output	Credit Card Bin Type	cc_bin_number_type	string	The type of Card (DEBIT, CREDIT, or CHARGE CARD)	false	CREDIT
Input, Output	Credit Card Hash	cc_number_hash	string	The Hash of the Credit Card number. The hashing must be performed by the customer performing the API call. The customer is required to add a Salt value that is not shared with Threatmetrix. Recommended is SHA-256 hash (in hexadecimal format) of the Credit Card Number. Accepted currently: SHA-1 (40 bytes) SHA-224 (56 bytes), SHA-256 (64 bytes), SHA-384 (96 bytes), SHA-512 (128 bytes).	false	SHA-256 using the following characters "0123456789abcdefABCDEF"
Output	Credit Card Hash Local Trust Tags	cc_number_hash_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Credit Card Hash Global Trust Tags	cc_number_hash_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	"_LOGIN_FAILED _THREAT _WATCH"
Output	Credit Card Hash First Seen	cc_number_hash_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2013-11-19
Output	Credit Card Hash Last Event	cc_number_hash_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-08
Output	Credit Card Hash Last Update	cc_number_hash_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-08
Output	Credit Card Hash Result	cc_number_hash_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Credit Card Hash Score	cc_number_hash_score	integer	The risk score between +100 (low to minimum risk) and -100 (high to maximum risk) for this entity.	false	-100 to +100
Output	Credit Card Hash Worst Score	cc_number_hash_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-100 to 0
Output	Credit Card Hash Assertion History	cc_number_hash_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	CONFIRMED_BAD
Output	Credit Card Hash Last Assertion	cc_number_hash_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-08-08
Input, Output	Not in Portal	challenge_credential	string	The challenge_credential field is used to pass in the telephone mumber of the user to whom the Step Up SMS is to be sent. Used for Step Up Authentication only.	false
Input, Output	Not in Portal	challenge_method	string	The method of Step Up challenge, e.g, "OneWaySMS"	false
Input, Output	Charset	charset	string	If present, this must be a valid charset otherwise fail_invalid_charset will be returned. If present and invalid character sequences are encountered, fail_invalid_character will be returned. NOTE: Charset conversion only applies for selected fields.	false
Output	CIDR Number	cidr_number	integer	This is a number in the range [0...31] indicating how close the true_ip is to the proxy_ip in terms of ip address.	false	20
Input, Output	Condition Attribute 1	condition_attrib_1	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 10	condition_attrib_10	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 11	condition_attrib_11	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 12	condition_attrib_12	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 13	condition_attrib_13	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 14	condition_attrib_14	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 15	condition_attrib_15	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 16	condition_attrib_16	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 17	condition_attrib_17	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 18	condition_attrib_18	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 2	condition_attrib_2	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 3	condition_attrib_3	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 4	condition_attrib_4	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 5	condition_attrib_5	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 6	condition_attrib_6	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 7	condition_attrib_7	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 8	condition_attrib_8	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 9	condition_attrib_9	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Output	CSS Image Loaded	css_image_loaded	string	TrustDefender Cloud: Indicates whether the CSS encoded image loaded successfully in the browser.	false	Yes/No
Input, Output	Custom Number 1	custom_count_1	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_1", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 2	custom_count_2	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_2", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 3	custom_count_3	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_3", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 4	custom_count_4	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_4", this parameter is returned to the customer. Value of this parameter is a count, the exact sense of that count is rule specific.	false
Input, Output	Custom Match ID 1	custom_match_1	string	An MD5 hash of the Custom_Velocity rule, if "Output As" custom_match_1 is selected	false
Input, Output	Custom Match ID 2	custom_match_2	string	An MD5 hash of the Custom_Velocity rule, if "Output As" custom_match_2 is selected	false
Input, Output	Custom Match ID 3	custom_match_3	string	An MD5 hash of the Custom_Velocity rule, if "Output As" custom_match_3 is selected	false
Input, Output	Custom Match ID 4	custom_match_4	string	An MD5 hash of the Custom_Velocity rule, if "Output As" custom_match_4 is selected	false
Input, Output	Custom Match ID 5	custom_match_5	string	An MD5 hash of the Custom_Velocity rule, if "Output As" custom_match_5 is selected	false
Input, Output	Custom Match ID 6	custom_match_6	string	An MD5 hash of the Custom_Velocity rule, if "Output As" custom_match_6 is selected	false	0
Input, Output	Custom Match ID 7	custom_match_7	string	An MD5 hash of the Custom_Velocity rule, if "Output As" custom_match_7 is selected	false
Input, Output	Custom Match ID 8	custom_match_8	string	An MD5 hash of the Custom_Velocity rule, if "Output As" custom_match_8 is selected	false
Input, Output	Custom Mobile 1	custom_mobile_1	string	A custom attribute passed to TrustDefender Mobile during the doProfileRequest call from the customer's parent application. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Mobile 2	custom_mobile_2	string	A custom attribute passed to TrustDefender Mobile during the doProfileRequest call from the customer's parent application. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Mobile 3	custom_mobile_3	string	A custom attribute passed to TrustDefender Mobile during the doProfileRequest call from the customer's parent application. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Mobile 4	custom_mobile_4	string	A custom attribute passed to TrustDefender Mobile during the doProfileRequest call from the customer's parent application.	false
Input, Output	Custom Mobile 5	custom_mobile_5	string	A custom attribute passed to TrustDefender Mobile during the doProfileRequest call from the customer's parent application.	false
Input, Output	Custom Output 1	custom_output_1	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as input in the condition rule.	false
Input, Output	Custom Output 10	custom_output_10	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as input in the condition rule.	false
Input, Output	Custom Output 2	custom_output_2	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as input in the condition rule.	false
Input, Output	Custom Output 3	custom_output_3	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as input in the condition rule.	false
Input, Output	Custom Output 4	custom_output_4	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as input in the condition rule.	false
Input, Output	Custom Output 5	custom_output_5	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as input in the condition rule.	false
Input, Output	Custom Output 6	custom_output_6	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as input in the condition rule.	false
Input, Output	Custom Output 7	custom_output_7	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as input in the condition rule.	false
Input, Output	Custom Output 8	custom_output_8	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as input in the condition rule.	false
Input, Output	Custom Output 9	custom_output_9	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as input in the condition rule.	false
Output	Event Time	api_call_datetime	timestamp	The time of event in the format: yyyy-mm-dd HH:MM:SS.mmm	false	2019-02-27 23:12:39.667
Output	Not in Portal	datetime	timestamp	The time of event in the format: yyyy-mm-dd HH:MM:SS.mmm	false	2019-02-27 23:12:39.667
Output	Flash Detected	detected_fl	string	This flag is set based on the detection of Flash using javascript.	false	Yes/No
Output	Exact ID Local Trust Tags	device_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_AUTH_FAILED _LOGIN_PASSED
Output	Exact ID Global Trust Tags	device_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_TRUSTED _TRUSTED_CONF _AUTH_FAILED _LOGIN_PASSED
Output	Device Fingerprint	device_fingerprint	string	Device fingerprint as calculated by the pagefingerprinting script.	false	b440329819db0aace5ce28dbb8b792028dcce047
Output	Device Fingerprint Local Trust Tags	device_fingerprint_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_AUTH_FAILED _LOGIN_PASSED
Output	Device Fingerprint Global Trust Tags	device_fingerprint_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_AUTH_FAILED _LOGIN_PASSED
Output	Device Fingerprint First Seen	device_fingerprint_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-16
Output	Device Fingerprint Last Event	device_fingerprint_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-17
Output	Device Fingerprint Last Update	device_fingerprint_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-17
Output	Device Fingerprint Result	device_fingerprint_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Device Fingerprint Score	device_fingerprint_score	integer	The risk score between +100 (low to minimum risk) and -100 (high to maximum risk) for this entity.	false	0
Output	Device Fingerprint Worst Score	device_fingerprint_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-31
Output	Exact ID First Seen	device_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-16
Output	Device Fingerprint Assertion History	device_fingerprint_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	CONFIRMED_GOOD
Output	Device Fingerprint Last Assertion	device_fingerprint_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-08-16
Output	Exact ID	device_id	string	ExactID™ is a persistent global identifier which relies on a variety of persistent markers (browser cookies, Adobe Flash cookies, HTML 5 local storage) to allow ThreatMetrix to 100% accurately identify a device. Note that the related entity attributes are named device_ (excluding the 'id' from the attribute names)	false	e2950be04a94513876782595133748f
Output	Device ID Confidence	device_id_confidence	float	Probability of this being the same device.	false	100
Output	Exact ID Last Event	device_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-16
Output	Exact ID Last Update	device_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-16
Output	Exact ID Match Result	device_match_result	string	Indicates whether this device is a new device, whether it was encountered before, and if not enough attributes were gathered to create a device identity.	false	success/new_device/not_enough_attribs
Output	Exact ID Result	device_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Exact ID Score	device_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false	-100 to 100
Output	Exact ID Worst Score	device_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-100 to 0
Output	Exact ID Last Assertion	device_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-08-16
Output	Exact ID Assertion History	device_assert_history	string	The assertion history for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	2017-08-16
Output	DNS IP	dns_ip	inet	The IP address of the DNS server	false	192.225.156.136
Output	DNS IP City	dns_ip_city	string	The city that the DNS IP is located in.	false	San Jose
Output	DNS IP Geo	dns_ip_geo	string	The 2 character ISO2 country code of the DNSIP Address.	false	US
Output	DNS IP ISP	dns_ip_isp	string	The ISP that the DNS IP address originates from.	false	Threatmetrix Inc.
Output	DNS IP Latitude	dns_ip_latitude	float	The latitude of the DNS IP.	false	37.33406
Output	DNS IP Line Speed	dns_ip_line_speed	string	Indicates the speed of the connection to the Internet, divided into: high, medium, or low. This information is determined by the Connection Type.	false	High
Output	DNS IP Longitude	dns_ip_longitude	float	The longitude of the DNS IP.	false	-121.89207
Output	DNS IP Organization	dns_ip_organization	string	The organization that the DNS IP address originates from.	false	Threatmetrix Inc.
Output	DNS IP Region	dns_ip_region	string	The state/region the DNS Ip originates from.	false	California
Output	DNS IP Routing Type	dns_ip_routing_type	string	The IP Routing Type (IPRT) specifies how the connection is routed through the Internet and can be used to determine how close the user is to the public IP address.	false	Fixed
Output	DNS IP Region Code	dns_ip_region_iso_code	string	The 2 letter ISO code for States for the United States and Canada	false	CA
Output	Drivers License Hash Local Trust Tags	drivers_licence_hash_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_FRAUD_PROB
Output	Drivers License Hash Global Trust Tags	drivers_licence_hash_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_AUTH_FAILED
Output	Drivers License Hash First Seen	drivers_licence_hash_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-07-17
Output	Drivers License Hash Last Event	drivers_licence_hash_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-07-17
Output	Drivers License Hash Last Update	drivers_licence_hash_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-07-17
Output	Drivers License Hash Result	drivers_licence_hash_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Drivers License Hash Score	drivers_licence_hash_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false	0
Output	Drivers License Hash Worst Score	drivers_licence_hash_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-25
Output	Drivers Licence Hash Assert History	drivers_licence_hash_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	NEGATIVE_HISTORY
Output	Drivers License Hash Last Assertion	drivers_licence_hash_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-07-17
Input, Output	Drivers License Hash	drivers_licence_number_hash	string	The hashing must be performed by the customer performing the API call. Recommeded is SHA-256 hash (in hexadecimal format) of the Drivers Licence. Accepted currently: SHA-1 (40 bytes) SHA-224 (56 bytes), SHA-256 (64 bytes), SHA-384 (96 bytes), SHA-512 (128 bytes)	false	SHA-256 using the following characters "0123456789abcdefABCDEF"
Output	Cookies Enabled	enabled_ck	string	Whether First party cookies which are required by most websites are ebabled. Not relelvent to mobile and default value for SDK profiling is 'no'.	false	yes/no
Output	Flash Enabled	enabled_fl	string	Whether Flash is enabled. Not relelvent to mobile and default value for SDK profiling is 'no'.	false	yes/no
Output	Images Enabled	enabled_im	string	Whether Images are enabled. Not relelvent to mobile and default value for SDK profiling is 'no'.	false	yes/no
Output	Javascript Enabled	enabled_js	string	Indicates if javascript is enabled inside the browser.Please note that this attribute is not relevant for Mobile and default value for SDK profiling is 'no'.	false	yes/no
Output	Enabled Services	enabled_services	string	Consisting of one or more flags which indicate which additional product components were used during the transaction, separated by commas.	false	Possible flags: Device ID enabled and billable = TMX100 Device ID enabled but not billable = TMX101 Page ID enabled and billable = TMX200 Page ID enabled not billable = TMX201 Billable Device ID and Non Billable Page ID = TMX100,TMX201 Non Billable Device ID and Billable Page ID = THM101,TMX200
Output	Error Detail	error_detail	string	Where request_result=fail_invalid_parameter, this field will indicate which parameter is invalid.	false	service_type
Output	Not in Portal	etag_guid	string	The etag guid in brower caches used to identify the brower so long as caching is enabled. This is not available for rules nor displayed in the portal.	false	17d2fc8d033b437ab5b2782c0f99fcbe
Output	Not in Portal	event_id	integer	The event id identifying the event	false
Input, Output	Event Type	event_type	string	Specifies the type of transaction or event.	false	Must be one of the following values: LOGIN - A user logging into an account. PAYMENT - Purchasing of goods/services. ACCOUNT_CREATION - The creation of a new account. TRANSFER -A money transfer between accounts. TRANSACTION_OTHER - Other transaction types. AUCTION_BID - An online auction bid. DETAILS_CHANGE - A change of account details. ADD_LISTING - A listing was added to an online auction site. ACCOUNT_BALANCE - An account balance request. TRANSACTION_HISTORY - An account transaction history was requested. DIGITAL_DOWNLOAD - An online purchase for software goods that were delivered electronically. DIGITAL_STREAM - An online purchase of digital media that was streamed to the user. FAILED_LOGIN - The login attempt failed authentication DEPOSIT - A deposit of funds was made into the account. LOAN_ACCEPTANCE - Represents a user accepting loan terms (making funds available). DEVICE_REGISTRATION - Registration of a new device. AUTH_TOKEN - Issuance of a token for user or device authentication PASSWORD_RESET - User performing a password reset out their account.
Output	Extra Port Connection	extra_port_conn	string	Port we successfully connected to, as part of proxy piercing	false	8080-0
Input, Output	Final Review Status	final_review_status	string	The Final Review Status returned by the ThreatMetrix Platform	false	pass, review, reject
Output	First Party Cookie	first_party_cookie	string	Customer generated profiling attribute.	false	34f046b204d04402a02cc6271ad46cf2
Output	Flash Anomaly	flash_anomaly	string	Indicates as "Yes" if Flash is installed but not enabled. Please note that for TD Mobile this is not gathered by Flash, though the value is the same.	false	Yes
Output	Flash Language	flash_lang	string	Operating System Update configuration detected on the device.Not in use for TD Mobile 2.3 (ios) and TD Mobile 3.0 (Android) onwards.	false	en
Output	Flash OS	flash_os	string	TrustDefender Cloud: The Operating System as reported by Flash. TrustDefender Mobile: The Operating System as reported by the TD Mobile library. Flash is NOT used on mobile to gather this information.Not in use for TD Mobile 2.3 (ios) and TD Mobile 3.0 (Android) onwards.	false	TrustDefender Mobile: iphone os, google
Output	Flash System State	flash_system_state	integer	This is the TCP timestamp value from the flash connect back, normalized into seconds.	false
Output	Flash Version	flash_version	string	TrustDefender Cloud: The version of Flash installed in the client browser.	false	MAC 26,0,0,151
Output	Smart ID Local Trust Tags	fuzzy_device_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_FRAUD_PROB
Output	Smart ID Global Trust Tags	fuzzy_device_attributes	string	The Global trust tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_AUTH_FAILED
Output	Smart ID First Seen	fuzzy_device_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-07-17
Output	Smart ID	fuzzy_device_id	string	SmartID is cookieless, and is based exclusively on device attribute to improve detection of returning visitors, especially those trying to elude identification, and reduces false positives. Note that the associated attribute entities are named as follows: fuzzy_device (omitting the 'id')	false	0c98866d3fbd449929c3dc50fd55e97a0
Output	Smart ID Confidence	fuzzy_device_id_confidence	float	The probability of this being the same device.	false	100
Output	Smart ID Last Update	fuzzy_device_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-07-17
Output	Smart ID Match Result	fuzzy_device_match_result	string	Indicates whether this device is a new device, whether it was encountered before, and if not enough attributes were gathered to create a device identity.	false	success/new_device/not_enough_attribs
Output	Smart ID Result	fuzzy_device_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Smart ID Score	fuzzy_device_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false	0
Output	Smart ID Worst Score	fuzzy_device_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-31
Output	Smart ID Assertion History	fuzzy_device_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	NEGATIVE_HISTORY
Output	Smart ID Last Assertion	fuzzy_device_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-07-17
Output	Smart ID Last Event	fuzzy_device_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-07-17
Output	Headers Name Value Hash	headers_name_value_hash	string	An MD5 hash of the names and values inside the http headers - frequently changing fields such as "cookie","if-modified","keep-alive","cache-control" are ignored when computing the hash.	false	80cdab6215d4712e8c820e2309b18517d
Output	Headers Order String Hash	headers_order_string_hash	string	An MD5Hash of the http header names in the order in which they appear within the http header	false	760bab6215d4712e8c820e2309b18517d
Output	Honeypot Fingerprint	honeypot_fingerprint	string	Non-modified page: SHA-1 hash (in hexadecimal format) of the honeypot page fingerprint.Modified page: SHA-2 hash (in hexadecimal format) of the honeypot page differences.	false	b650c26ea9ffd1e5f55bd6a5ac78ee15d7d1daaa
Output	Not in Portal	honeypot_fingerprint_check	string	True/False boolean flag indicating if the page fingerprint collected matches the reference page fingerprint.	false	True/False/Null
Output	Honeypot Fingerprint Differences	honeypot_fingerprint_diff	string	Lists all differences between the original page and the modified page that are known to ThreatMetrix as it belongs to its database of known black/white/gray listed entries. Presented as a comma separated list.	false	Whitelist : Firefox Lastpass HP Win10-deenSYS
Output	Honeypot Fingerprint Hooks	honeypot_fingerprint_hooks	string	Any hooked JavaScript methods found for the honeypot page	false	document.createElement%3Afunction%20()%7Bvar%20e%3Dt.apply(this%2Carguments) %3Breturn%20e%26%26%22FORM%22%3D%3D%3De.nodeName%26%
Output	Honeypot Fingerprint Match	honeypot_fingerprint_match	string	Indicates whether a match or mismatch was found and the exact type of match and mismatch that occurred between the collected and reference fingerprints.	false	match_exact:page fingerprint matched the reference honeypot fingerprint exactly with NO known page differences. mismatch_white: fingerprint did NOT match the reference honeypot fingerprint, but the mismatch was due to known, white-listed page differences and is therefore considered safe. mismatch_grey: fingerprint did NOT match the reference honeypot fingerprint, but the mismatch was due to known, neutral-listed page differences and may present a security risk. Adware or spyware may be present on the device performing this transaction. mismatch_black: fingerprint did NOT match the reference honeypot fingerprint, and the mismatch was due to known, black-listed page differences and presents a security risk. Malware is present on the device performing this transaction. mismatch_unknown:fingerprint did NOT match the reference honeypot fingerprint, and the mismatch was due to unknown page differences and may present a security risk. Malware is present on the device performing this transaction. not_detected:This would be the case if TDCloud runs, but cannot calculate the page differences.
Output	Honeypot Unknown Differences	honeypot_unknown_diff	string	Lists all differences between the original page and the modified page that are not present in ThreatMetrix's list of black/white/gray listed entries, and are therefore unknown. Presented in the Page Description Language (PDL).	false
Output	HTTP OS Signature	http_os_signature	string	The operating system type of the device OR proxy (if present) as detected by TCP profiling.	false
Output	HTTP Referer	http_referer	string	The encrypted version of the domain from the referer url.	false	glBoE8n81mMb06dbfj9L6!JAFGcOkK68
Output	HTTP Referer Domain	http_referer_domain	string	TD Cloud: The domain of the HTTP referrer detected during profiling. TD Mobile: This field can be optionally populated by the ‘Custom URL’ option in the TrustDefender Mobile Library. This relates to the http_referer_url attribute below but only includes the domain portion of the passed URL as opposed to the whole URL which is present in the http_referrer_url attribute. This is passed to the library by the customer’s native application. Described in more detail in the TMX Knowledgebase, Article ID 378.	false	Mobile Example-http://com.example.trustdefendermobile.sample /mobile
Output	Not in Portal	http_referer_domain_activities	string	The Local Trust Tags for this entity.	false	_FRAUD_PROB
Output	Not in Portal	http_referer_domain_attributes	string	The Global Trust Tags for this entity.	false	_AUTH_FAILED
Output	Not in Portal	http_referer_domain_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-07-17
Output	Not in Portal	http_referer_domain_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-17
Output	Not in Portal	http_referer_domain_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-17
Output	HTTP Referer Domain Result	http_referer_domain_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Not in Portal	http_referer_domain_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false	0
Output	Not in Portal	http_referer_domain_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-35
Output	Not in Portal	http_referer_domain_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE.	false	SUSPICIOUS
Output	Not in Portal	http_referer_domain_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-08-17
Output	HTTP Referer URL	http_referer_url	string	TD Cloud: The URL of the HTTP referrer detected during profiling. TD Mobile: This field can be optionally populated by the ‘Custom URL’ option in the TrustDefender Mobile Library. This is passed to the library by the customer’s native application. Described in more detail in the TMX Knowledgebase, Article ID 378.	false	http://example2/
Output	Hardware GPS Accuracy	hw_gps_accuracy	float	The accuracy rating, in meters, of the location collected via the location services API. In Android, either Fine Location or Coarse Location must be enabled. In iOS, the application must specify the message used during the permission prompt by adding an entry to the application.plist file-- see the KB's articles under ThreatMetrix SDK.	false	100
Output	Hardware Latitude	hw_latitude	float	The latitude collected from the location services API. In Android, either Fine Location or Coarse Location must be enabled. In iOS, the application must specify the message used during the permission prompt by adding an entry to the application.plist file-- see the KB's articles under ThreatMetrix SDK.	false	Example value-hw_latitude : -37.82465426 (degrees.minutes)
Output	Hardware Longitude	hw_longitude	float	The longitude collected from the location services API. In Android, either Fine Location or Coarse Location must be enabled. In iOS, the application must specify the message used during the permission prompt by adding an entry to the application.plist file-- see the KB's articles under ThreatMetrix SDK.	false	Example Value-145.22554548 (degrees.minutes)
Output	Image Anomaly	image_anomaly	string	Indicates as "Yes" if there was an anomaly associated with images loading in the browser. Otherwise this attribute does not appear.	false	Yes
Output	Image Loaded	image_loaded	string	TrustDefender Cloud: Indicates as "Yes" if the PNG image included in the profiling tags was loaded. TrustDefender Mobile: this attribute should be ignored.	false	Yes
Output	Industry Description	industry_desc	string	DEPRECATED	false	BANKING NONBANK FINANCE COMP_ELECTRONICS FLOWER_GIFTS
Output	Input IP Local Trust Tags	input_ip_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_LOGIN_PASSED _LOGIN_PASSED : LOGIN PASSED
Input, Output	Input IP	input_ip_address	inet	The IP address (Internet Protocol address) inputted by the customer, including both IPv4 and IPv6 addresses. The IP address must be a valid external address. If an invalid external IP address is passed into the transaction, the value is removed from the transaction. The Event Detail Reasons for the transaction will then reflect INVALID_input_ip_address.	false	10x.56.76.1xx
Output	Input IP Worst Score	input_ip_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-25
Output	Input IP Global Trust Tags	input_ip_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	CONFIRMED_BAD LAST_ACTIVITY_AGE2
Output	Input IP City	input_ip_city	string	The city the Input IP Address is located in	false	Washington
Output	Input IP First Seen	input_ip_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-04-19
Output	Input IP Geo	input_ip_geo	string	The 2 character ISO2 country code of the Input IP Address.	false	US
Output	Input IP Region Code	input_ip_region_iso_code	string	The 2 letter ISO code for States for the United States and Canada	false	CA
Output	Input IP ISP	input_ip_isp	string	The ISP that the Input IP address originates from.	false	abc communications services inc.
Output	Input IP Last Event	input_ip_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-04-19
Output	Input IP Last Update	input_ip_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-04-19
Output	Input IP Latitude	input_ip_latitude	float	The latitude of the Input IP address	false	38.9069
Output	Input IP Longitude	input_ip_longitude	float	The longitude of the Input IP address	false	-77.0284
Output	Input IP Organization	input_ip_organization	string	The organization that the Input IP address originates from	false	abc communications services inc.
Output	Input IP Region	input_ip_region	string	The region the Input IP Address is located in	false	California
Output	Input IP Result	input_ip_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Input Ip Routing Type	input_ip_routing_type	string	The IP Routing Type (IPRT) specifies how the connection is routed through the Internet and can be used to determine how close the user is to the public IP address.	false	Fixed
Output	Input IP Score	input_ip_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false	6
Output	Input Ip Assertion History	input_ip_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	SUSPICIOUS
Output	Input IP Last Assertion	input_ip_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2012-04-19
Input, Output	Input Request ID	input_request_id	string	The original Request ID Passed in the Query API for checking the review status of transactions	false	848dbc95b3eb4cac80ecea54308a147b
Input, Output	IP Activities Description	ip_activities_desc	string	Describes the IP activity from the list of possible values in the next column.	false	PHISH NIGERIAN UDP_SCAN_FLAG TCP_SCAN_FLAG CONNECTING_TO_BOTNET CONNECTING_TO_MALWARE_SITE IRC_CONNECTION_ANOMALY DNS_CONNECTION_ANOMALY BANK CLICK_FRAUD MALWARE INSTANT_MSG P2P SPAM LEGITIMATE OTHER
Input	IP Attributes Description	ip_attributes_desc	string	Describes the type of IP from the list of possible values in the right column.	false	DYNAMIC STATIC BOGON HIJACKED BOTNET_ZOMBIE OPEN_RELAY OPEN_PROXY PROXY NAME_SERVER RANGE PORTAL
Output	Jailbreak or Root	jb_root	integer	Detects whether a mobile device running TrustDefender Mobile has Root privileges on Android, or a Jailbroken iOS device. This stores a numerical value that indicates the number of jailbreak/root elements on a device. 0 indicates that there were no jailbreak/root elements detected.	false	9
Output	Jailbreak or Root Reason	jb_root_reason	string	A comma separated string containing additional information that describes the element(s) on the device that triggered the Jailbreak or Root detection.	false	file:///private/var/stash;file://System/Library/PreferenceBundles/tsProtectorSettings.bundle;file:/
Output	Javascript Browser String	js_browser_string	string	User agent string as visible to Javascript. Will appear only if it is different from the HTTP browser_string.	false	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:54.0) Gecko/20100101 Firefox/54.0
Output	Javascript Font Hash	js_fonts_hash	string	An MD5 hash of the fonts installed on the device as gathered by JavaScript.	false	dab13aceb91c50ffc88ea348249705a3
Output	Javascript Font List	js_fonts_list	string	Comma separated list of the first 100 fonts detected by JS (not Flash)	false	Chalkboard SE,Avenir Next Condensed,Avenir Next,Avenir,Apple SD Gothic Neo,Yuppy TC,Yuppy SC,STXihei,STIXGeneral-Regular,STIXGeneral-Bold,Songti SC,Osaka-Mono,Nanum Myeongjo,NanumMyeongjo,Nanum Gothic,NanumGothic,Marion,Kaiti SC,Gurmukhi Sangam MN
Output	Javascript Font Count	js_fonts_number	integer	The number of fonts intalled on the device as gathered by JavaScript	false	25
Input, Output	Custom Attribute 1	local_attrib_1	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 10	local_attrib_10	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 2	local_attrib_2	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 3	local_attrib_3	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 4	local_attrib_4	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 5	local_attrib_5	string	These attributes can be used to pass custom attribute data that can be used by rules When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 6	local_attrib_6	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 7	local_attrib_7	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 8	local_attrib_8	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 9	local_attrib_9	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 11	local_attrib_11	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 12	local_attrib_12	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 13	local_attrib_13	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 14	local_attrib_14	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Custom Attribute 15	local_attrib_15	string	These attributes can be used to pass custom attribute data that can be used by rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Output	Local Time Offset	local_time_offset	float	This is time difference between the device's clock and the profiling server's clock in seconds.	false
Output	Local Time Offset Range	local_time_offset_range	float	This is the error or confidence associated with the local_time_offset.	false
Output	MIME Type Hash	mime_type_hash	string	A SHA-1 Hash of all mime types supported by the browser.	false	cf79efbf4ca0d31161523d23394e357e
Output	MIME Type Number	mime_type_number	integer	The number of mime types supported by the browser.	false	2
Output	Multiple Session ID	multiple_session_id	string	This is returned as Yes if the same session_id is used during two different profiling sessions (NOT API call). Note that the profiling sessions must occur within 2 minutes of each other for the flag to be raised.	false	Yes
Output	Offset Measure Time	offset_measure_time	integer	Time at which local_time_offset was calculated expressed as seconds since Midnight, January 1 1970—Unix time.	false
Output	Online ID	online_id	string	This field is a combination of online_tld and online_id_handle, and returned as an output. The values are separated by an underscore. The online_Id field is available for use in rules and forensics, and can be used to match on a customer or 3rd party supplied identifier.	false	254845778_duns
Output	Online ID Local Trust Tags	online_id_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	Online ID Global Trust Tags	online_id_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	Online ID First Seen	online_id_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2019-02-14
Input, Output	Online ID Handle	online_id_handle	string	A unique third-party identifier, such as a LexID or a DUNS Number. Please use online_id for rule creation and investigation. Warning: If online_id_handle is passed in an API request, you must pass an online_tld.	false	254845778
Output	Online ID Last Event	online_id_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2019-02-14
Output	Online ID Last Update	online_id_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2019-02-14
Output	Online ID Result	online_id_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Online ID Score	online_id_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false
Output	Online ID Assertion History	online_id_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	SUSPICIOUS
Output	Online ID Last Assertion	online_id_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2012-04-19
Output	Online ID Worst Score	online_id_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false
Input, Output	Online Tld	online_tld	string	Description of the online_id_handle source. Used to prevent collisions between different online_id_handles. Warning: If online_tld is passed in an API request, you must pass an online_id_handle. Please work with an architect to determine the correct online_tld for the ID you wish to send with your query.	false	duns
Input, Output	Not in Portal	org_id	string	The unique Organization ID that identifies the organization within ThreatMetrix	false
Output	OS	os	string	The operating system of the device according to the Operating System detection engine. This is a normalized value containing only the OS name (no os version or build information is appended). Unknown: Unable to determine the operating system. Other: OS was detected, but did not belong to one of the above possible values. Please consult ThreatMetrix support for more information.	false	Windows, OS X, Linux, iOS, Android, Windows Mobile, Blackberry, Unknown, Other
Output	OS Anomaly	os_anomaly	string	Indicates as "Yes" if the operating system of the browser is NOT the same as the operating system as detected by TCP profiling. Otherwise this attribute does not appear.	false	Yes
Output	Font Hash	os_fonts_hash	string	An MD5 hash of the fonts installed on the device.	false
Output	Font Count	os_fonts_number	integer	The number of fonts installed on the device.	false
Output	Page Fingerprint	page_fingerprint	string	The "fingerprint" of the reference page based on the content structure of the page.	false	da39a3ee5e6b4b0d3255bfef95601890afd80709
Output	Page Fingerprint Local Trust Tags	page_fingerprint_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_FRAUD_PROB
Output	Page Fingerprint Global Trust Tags	page_fingerprint_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_AUTH_FAILED
Output	Not in Portal	page_fingerprint_check	string	True/False boolean flag indicating if the page fingerprint collected matches the reference page fingerprint.	false	True/False
Output	Page Fingerprint Differences	page_fingerprint_diff	string	Contains a comma separated list of known predefined page differences: ":, :, ... , " an example would be "Browser Extension:LastPass"	false	0
Output	Page Fingerprint First Seen	page_fingerprint_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-07-17
Output	Page Fingerprint Last Assertion	page_fingerprint_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format. DEPRECATED	false	2017-04-07
Output	Page Fingerprint Assertion History	page_fingerprint_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_NEGATIVE_HISTORY
Output	Page Fingerprint Hooks	page_fingerprint_hooks	string	Any hooked JavaScript methods found by Page Fingerprinting.	false
Output	Page Fingerprint Last Event	page_fingerprint_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-07-17
Output	Page Fingerprint Last Update	page_fingerprint_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-07-17
Output	Page Fingerprint Match	page_fingerprint_match	string	Indicates whether a match or mismatch was found and the exact type of match and mismatch that occurred between the collected and reference fingerprints.	false	match_exact:Client-side page fingerprint matched the reference page fingerprint exactly with NO known page differences mismatch_white:Client-side fingerprint did NOT match the reference fingerprint, but the mismatch was due to known, white-listed page differences and is therefore considered safe. mismatch_grey:Client-side fingerprint did NOT match the reference fingerprint, but the mismatch was due to known, neutral-listed page differences and may present a security risk. Adware or spyware may be present on the device performing this transaction. mismatch_black:Client-side fingerprint did NOT match the reference fingerprint, and the mismatch was due to known, black-listed page differences and presents a security risk. Malware is present on the device performing this transaction. mismatch_unknown:Client-side fingerprint did NOT match the reference fingerprint, and the mismatch was due to unknown page differences and may present a security risk.not_detected:This would be the case if TDCloud runs, but cannot calculate the page differences.
Output	Page Fingerprint Result	page_fingerprint_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Page Fingerprint Score	page_fingerprint_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false
Output	Page Fingerprint Worst Score	page_fingerprint_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-20
Input, Output	Page ID	page_id	integer	Indicates which page is being profiled, assuming that more than 1 page has ThreatMetrix/TrustDefender tags.	false	1
Output	Page Summary	page_summary	string	Brief textual indication of what differences were detected in the page if applicable.	false	inputs={} jselements={0} hosts={}
Output	Time spent on page	page_time_on	integer	This is the time period in milliseconds indicating how long the profiling page stays on the browser before it's navigated away or closed.	false	130807
Input, Output	Password Hash	password_hash	string	The hashing must be performed by the customer performing the API call. Recommeded is SHA-256 hash (in hexadecimal format) of the password. Accepted currently: SHA-1 (40 bytes) SHA-224 (56 bytes), SHA-256 (64 bytes), SHA-384 (96 bytes), SHA-512 (128 bytes)	false	SHA-256 using the following characters "0123456789abcdefABCDEF"
Output	Password Hash Local Trust Tags	password_hash_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_FRAUD_PROB
Output	Password Hash Global Trust Tags	password_hash_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_AUTH_FAILED
Output	Password Hash First Seen	password_hash_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2019-02-14
Output	Password Hash Last Event	password_hash_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2019-02-14
Output	Password Hash Last Update	password_hash_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2019-02-14
Output	Password Hash Result	password_hash_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Password Hash Score	password_hash_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false
Output	Password Hash Worst Score	password_hash_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false
Output	Password Hash Assertion History	password_hash_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	SUSPICIOUS
Output	Password Hash Last Assertion	password_hash_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2012-04-19
Input, Output	Payment Gateway Provider	payment_gateway_provider	string	The payment gateway provider of the merchant. CYBERSOURCE GLOBALCOLLECT OTHER	false
Input, Output	Payment Request Type	payment_request_type	string	The payment request type (If EVENT_TYPE = PAYMENT); this field is used to determine if the payment is an authorization request or reversal. AUTHORISATION – payment authorization request. NONE – not applicable.	false	0
Input, Output	Payment Response	payment_response	string	This field used to determine if payment was accepted. Default SUCCESSFUL = request was successful DECLINED = request was declined ERROR = there was an error in the request Cybersource specific response codes -1 = Error 0 = Declined 1 = Successful	false
Input, Output	Payment Response Code	payment_response_code	string	Global Collect 0 = CREATED 160 = DENIED 200 = CARDHOLDER AUTHENTICATED 220 = COULD NOT AUTHENTICATE 525 = CHALLENGED Cybersource DAVSNO = The credit card was accepted by the bank but refused by CyberSource because it did not pass the Address Verification Service test. DCALL = The transaction is declined. To try to resolve the issue, call the issuing bank or the customer. DCARDEXPIRED = CyberSource declined the request because the credit card has expired. You may also receive this reason code if the expiration date that you provided does not match the date on file at the issuing bank. If the payment processor allows issuance of credits to expired cards, CyberSource does not limit this functionality. DCARDREFUSED = The bank declined the transaction. This reply flag includes declines due to insufficient funds, which cannot be differentiated from other transactions at the time of authorization. DCV= The credit card was accepted by the bank but refused by CyberSource because it did not pass the card verification number check. DINVALIDADDRESS = The customer entered an invalid city, state, country, or postal code. DINVALIDCARD = The account number does not pass CyberSource basic checks. DINVALIDDATA = The data provided is not consistent with the request. For example, you requested a product with negative cost. DINVALIDPROD = Not enough information is provided to generate the download URL. DMISSINGFIELD = The request is missing a required field. DREJECT = This is the Decision Manager default reply flag for the orders that you want to reject. DNOAUTH = The transaction is declined because the authorization is invalid. DREVIEW = This is the Decision Manager default reply flag for the orders that you want to review. DRESTRICTED = One or both of these problems may have occurred: The customer is on a list issued by the U.S.government; The U.S. government maintains an economic embargo against the country indicated in the billing or shipping address. DSCORE = The score exceeds the threshold that you set for the profile. ESYSTEM = System error. Wait a few minutes, and try sending your request again. ETIMEOUT = The request timed out. SOK= The transaction was successful.	false	0
Output	Plug-in Adobe Acrobat	plugin_adobe_acrobat	string	The value is true or version number XX.XX.XX.XX - Only available in FireFox in JP1.	false	17.009.20044
Output	Plug-in DevalVR	plugin_devalvr	string	The value is true or version number XX.XX.XX.XX.	false
Output	Plug-in Flash	plugin_flash	string	The value is true or version number XX.XX.XX.XX - Only available in FireFox in JP1.	false	25.0 r0
Output	Plug-in Hash	plugin_hash	string	The Sha-1 Hash of all installed browser plugins. This is gathered using the navigator.plugins javascript WebAPI.	false	7r52fe82ebd672ec0bc80452dfdde784
Output	Plug-in Java	plugin_java	string	The value is true or version number XX.XX.XX.XX.	false	true
Output	Plug-in Number	plugin_number	integer	The number of plugins – Only available for non-IE.	false	2
Output	Plug-in Quicktime	plugin_quicktime	string	The value is true or the version number XX.XX.XX.XX.	false	4
Output	Plug-in Realplayer	plugin_realplayer	string	The value is true or the version number XX.XX.XX.XX - Only available in FireFox in JP1.	false
Output	Plug-in Shockwave	plugin_shockwave	string	The value is true or the version number XX.XX.XX.XX - Only available in FireFox in JP1.	false	12.1
Output	Plug-in Silverlight	plugin_silverlight	string	The value is true or the version number XX.XX.XX.XX - Only available in FireFox in JP1.	false
Output	Plug-in SVG Viewer	plugin_svg_viewer	string	The value is true or version number XX.XX.XX.XX.	false
Output	Plug-in VLC Player	plugin_vlc_player	string	The value is true or version number XX.XX.XX.XX.	false
Output	Plug-in Windows Media Player	plugin_windows_media_player	string	The value is true or the version number XX.XX.XX.XX - Only available in FireFox in JP1	false
Input, Output	Policy	policy	string	The name of the policy.	false	Default
Output	Policy Score	policy_score	integer	The policy score of the policy which is calculated based on the sum of the risk weights for each of the rules configured within it.	false	50
Input	Processing Provider	processing_provider	string	Global Collect 0 = CREATED 160 = DENIED 200 = CARDHOLDER AUTHENTICATED 220 = COULD NOT AUTHENTICATE 525 = CHALLENGED Cybersource DAVSNO = The credit card was accepted by the bank but refused by CyberSource because it did not pass the Address Verification Service test. DCALL = The transaction is declined. To try to resolve the issue, call the issuing bank or the customer. DCARDEXPIRED = CyberSource declined the request because the credit card has expired. You may also receive this reason code if the expiration date that you provided does not match the date on file at the issuing bank. If the payment processor allows issuance of credits to expired cards, CyberSource does not limit this functionality. DCARDREFUSED = The bank declined the transaction. This reply flag includes declines due to insufficient funds, which cannot be differentiated from other transactions at the time of authorization. DCV= The credit card was accepted by the bank but refused by CyberSource because it did not pass the card verification number check. DINVALIDADDRESS = The customer entered an invalid city, state, country, or postal code. DINVALIDCARD = The account number does not pass CyberSource basic checks. DINVALIDDATA = The data provided is not consistent with the request. For example, you requested a product with negative cost. DINVALIDPROD = Not enough information is provided to generate the download URL. DMISSINGFIELD = The request is missing a required field. DREJECT = This is the Decision Manager default reply flag for the orders that you want to reject. DNOAUTH = The transaction is declined because the authorization is invalid. DREVIEW = This is the Decision Manager default reply flag for the orders that you want to review. DRESTRICTED = One or both of these problems may have occurred: The customer is on a list issued by the U.S.government; The U.S. government maintains an economic embargo against the country indicated in the billing or shipping address. DSCORE = The score exceeds the threshold that you set for the profile. ESYSTEM = System error. Wait a few minutes, and try sending your request again. ETIMEOUT = The request timed out. SOK= The transaction was successful.	false
Output	Profiled Domain	profiled_domain	string	TD Cloud: The URL (i.e. domain + path + querystring) of the referring page. TD Mobile: Same as the http_referer_domain attribute. Maybe used as an input in condition rules and as a secondary attribute in Smart Rules.	false
Output	Not in Portal	profiled_domain_attributes	string	The Global Trust Tags for this entity.	false
Output	Not in Portal	profiled_domain_activities	string	The Local Trust Tags for this entity.	false
Output	Not in Portal	profiled_domain_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2019-02-14
Output	Not in Portal	profiled_domain_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2019-02-14
Output	Not in Portal	profiled_domain_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2019-02-14
Output	Not in Portal	profiled_domain_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Not in Portal	profiled_domain_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false
Output	Not in Portal	profiled_domain_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false
Output	Not in Portal	profiled_domain_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE.	false
Output	Not in Portal	profiled_domain_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2019-02-14
Input, Output	Profiled URL	profiled_url	string	TD Cloud: The URL (domain+path+querystring) of the profiled page. TD Mobile: Same as the http_referer_domain attribute	false	Example: This field can be optionally populated by the ‘Custom URL’ option in the TrustDefender Mobile Library. This is passed to the library by the customer’s native application.
Output	Profile Time	profiling_datetime	integer	The arrival time of the first fingerprint attribute (for this session), expressed in seconds since Midnight January 1, 1970—Unix time.	false	1550439563
Output	Not in Portal	profiling_delta	integer	The profiling delta time in millisecond between the profiling begin and ending.	false	3006
Output	Proxy IP	proxy_ip	inet	If available, the IP address of the proxy.	false
Output	Proxy IP Local Trust Tags	proxy_ip_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	Proxy IP Global Trust Tags	proxy_ip_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	Proxy IP City	proxy_ip_city	string	The city the Proxy IP is located in.	false
Output	Proxy IP First Seen	proxy_ip_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2019-02-14
Output	Proxy IP Geo	proxy_ip_geo	string	The 2 character ISO2 country code of the proxy ip country: http://www.iso.org/iso/country_codes.	false	US
Output	Proxy IP Region Code	proxy_ip_region_iso_code	string	The 2 letter ISO code for States for the United States and Canada	false	CA
Output	Proxy IP ISP	proxy_ip_isp	string	The ISP that the Proxy IP address originates from.	false
Output	Proxy IP Last Event	proxy_ip_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2019-02-14
Output	Proxy IP Last Update	proxy_ip_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2019-02-14
Output	Proxy IP Assertion History	proxy_ip_assert_history	string	The assertion ihstory for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	Proxy IP Last Assertion	proxy_ip_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2019-02-14
Output	Proxy IP Latitude	proxy_ip_latitude	float	The latitude of the Proxy IP address.	false
Output	Proxy IP Longitude	proxy_ip_longitude	float	The longitude of the Proxy IP address.	false
Output	Proxy IP Organization	proxy_ip_organization	string	The organization that the Proxy IP address originates from.	false
Output	Proxy IP Region	proxy_ip_region	string	The region the Proxy IP is located in.	false
Output	Proxy IP Result	proxy_ip_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Proxy IP Score	proxy_ip_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false
Output	Proxy IP Worst Score	proxy_ip_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false
Output	Proxy Name	proxy_name	string	The potential CGI proxy name.	false
Output	Proxy Type	proxy_type	string	Used to classify the type, and hence risk of the proxy in real time No – no proxy is detected Hidden – proxy is trying to avoid detection. This is the highest risk proxy type. Open – proxy is an open proxy Transparent – proxy is a transparent proxy	false
Output	Reasons	reason_code	string	The names of rules from the selected policy that have triggered. Each rule name is returned as a separate name/value pair.	false
Output	Related Custom ID	related_custom_id	string	Persona ID related attribute: this will return the transaction_id attribute for the top 5 related transactions, based on the descending timestamp of each transaction (e.g. the 5 most recent related transaction_ids)	false
Output	Related Exact ID	related_device_id	string	Persona ID related attribute: the top 5 related device ids in descending date time order.	false
Output	Related Request ID	related_request_id	string	Persona ID related attribute: this allows the user to choose one custom attribute (either Pivot 1->4 OR Secondary 1 ->6) and will return the value for the top 5 related transactions, based on the descending timestamp of each transaction.	false
Output	Remote Desktop	remote_desktop	string	Indicates if a port commonly used by remote desktop applications is active. This functions only for TrustDefender Cloud via the browser based profiling tags.	false	Example Value: RDP:3389 where RDP is the name of the remote desktop tool and 3389 is the port number. Can contain multiple values separated by comma.
Output	Request Duration	request_duration	integer	This is the total time taken to process the request, in milliseconds	false
Input, Output	Request ID	request_id	string	This is a unique value (GUID) associated with the API event. This is automatically generated every time an API call is made.	false	Example Value: 63379357-B350-4874-AEFA-48D1A108C68F
Output	Request ID Activities	request_id_activities	string	The Local Trust Tags for this entity.	false
Output	Request Result	request_result	string	The result for the request. See List of Request Result Values.	false	success - ThreatMetrix was able to process the request successfully.
Input, Output	Review Status	review_status	string	Status mapped according to policy score.	false	Possible values: reject, review, pass, challenge ('challenge' is used in step-up and strong authentication scenarios).
Output	Risk Rating	risk_rating	string	Risk mapped according to THREATMETRIX policy score.	false	Possible values: high, medium, low, neutral, trusted
Output	Screen Aspect Ratio Anomaly	screen_aspect_ratio_anomaly	string	Detects if screen aspect ratio is not in the list of acceptable screen aspect ratios, otherwise this attribute does not appear	false	Yes
Output	Screen Color Depth	screen_color_depth	integer	The screen color depth is the number of bits per pixel on a computer monitor to represent a specific color	false	24
Output	Screen Resolution	screen_res	string	The normalized value for the screen resolution of the device with the higher value reported first.	false	1920x1080
Output	Screen Resolution Anomaly	screen_res_anomaly	string	"Yes" only if the screen resolution is not in the list of acceptable screen resolutions.	false	Yes
Input, Output	Service Type	service_type	string	This filtering parameter restricts which output fields are returned based on the level of access that a customer has. The service type is linked to an API Key and verified during a call.	false	All, Session-Policy
Output	Session Anomaly	session_anomaly	string	Indicates as "Yes" if the browser_string_hash or first_party_cookie changes during the session, and also if the TCP profiling detects changes in the operating system. Otherwise this attribute does not appear.	false	Yes
Input, Output	Session ID	session_id	string	This is a session identifier generated when device profiling was initiated, and it should be unique per profiling event. Truncates to 128 characters in the API response limit is exceeded.	false
Input, Output	Settlement Amount	settlement_amount	float	This is the value that the customer deals in, if different from Transaction Amount. Maximum value is 999 999 999 999 999.99.	false
Input, Output	Settlement Currency	settlement_currency	string	This is the currency that the customer receives the payment in, if different from Transaction Currency. Currency type is validated and a reason code is generated if the type is incorrectly denoted (TMX_INVALID_SETTLEMENT_CURRENCY). For the currencies that have more than 2 decimal places, and only those, we allow the full number of decimal places. See https://www2.1010data.com/documentationcenter/beta/1010dataUsersGuide/DataTypesAndFormats/currencyUnitCodes.html for currencies that accept more than 2 decimal places.	false
Output	Shipping Address Local Trust Tags	Shipping_address_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	Shipping Address Global Trust Tags	Shipping_address_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Input, Output	Shipping Address City	shipping_address_city	string	The city component of the shipping address.	false
Input, Output	Shipping Address Country	shipping_address_country	string	The 2 character ISO2 country code of the shipping address country. If the API call includes the country, then ThreatMetrix's policy engine will try and locate a latitude and longitude value for the country. If the country cannot be located in the database, then the following reason code is returned: Shipping_Address_Geolocation_country_not_found	false
Output	Shipping Address First Seen	Shipping_address_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2019-02-14
Output	Shipping Address Last Event	Shipping_address_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2019-02-14
Output	Shipping Address Last Update	Shipping_address_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2019-02-14
Output	Shipping Address Result	Shipping_address_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Shipping Address Score	Shipping_address_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false
Input, Output	Shipping Address State	shipping_address_state	string	The state component of the shipping address.	false
Input, Output	Shipping Address Street 1	shipping_address_street1	string	The first portion of the street address component of the shipping address.	false
Input, Output	Shipping Address Street 2	shipping_address_street2	string	The second portion of the street address component of the shipping address.	false
Output	Shipping Address Worst Score	Shipping_address_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false
Output	Shipping Address Assertion History	shipping_address_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	Shipping Address Last Assertion	Shipping_address_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2019-02-14
Input, Output	Shipping Address Zip	shipping_address_zip	string	The zip/postal code of the shipping address. If the API call includes the zip code, then ThreatMetrix's policy engine will try and locate a latitude and longitude value for the zip code. If the zip code cannot be located in the database, then the following reason code is returned: Account_Address_Geolocation_zip_not_found	false
Input, Output	SSN Hash	ssn_hash	string	The hashing must be performed by the customer performing the API call. Recommeded is SHA-256 hash (in hexadecimal format) of the Social Security Number. Accepted currently: SHA-1 (40 bytes) SHA-224 (56 bytes), SHA-256 (64 bytes), SHA-384 (96 bytes), SHA-512 (128 bytes)The hashing must be performed by the customer performing the API call.	false	SHA-256 using the following characters "0123456789abcdefABCDEF"
Output	SSN Hash Local Trust Tags	ssn_hash_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	SSN Hash Global Trust Tags	ssn_hash_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	SSN Hash First Seen	ssn_hash_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2019-02-14
Output	SSN Hash Last Event	ssn_hash_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2019-02-14
Output	SSN Hash Last Update	ssn_hash_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2019-02-14
Output	SSN Hash Result	ssn_hash_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	SSN Hash Score	ssn_hash_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false
Output	SSN Hash Worst Score	ssn_hash_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false
Output	SSN Hash Assertion History	ssn_hash_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	SSN Hash Last Assertion	ssn_hash_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2019-02-14
Output	State	state	string	Bit mask field used by pagefingerprinting.	false
Output	Summary Reasons	summary_reason_code	string	The summary reason codes generated by the customer's selected policy which triggered the rules. The summary reason code is used for the easy identification of a set of rules by using a common summary field for them. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	System State	system_state	integer	This is the TCP timestamp value, normalized into seconds	false
Input, Output	Tag Behavior	tag_behavior	string	Used to indicate the behavior of the trust tag when using the Update API. Defaults to Update if none is specified.	false	update insert replace
Input, Output	Tag Context	tag_context	string	The Trust Tag Context from one of ThreatMetrix's Predefined set of Contexts must be passed. ONLY one Context may be passed within one call.	false
Input, Output	Tag Entity Logic	tag_entity_logic	string	The Entity logic for using the Query/Update API for trust tags checking and updating:	false
Input, Output	Tag Name	tag_name	string	The Trust Tag Name from one of ThreatMetrix's predefined set of Global Trust Tags. This field is used to pass in the trust tag names for the Query/Update APIs. Multiple tag names may be passed.	false
Output	TCP OS Signature	tcp_os_signature	string	The operating system type as detected by TCP profiling A value of "normalized" means the TM FC Saas has identified the remote device's OS Signature as that of a Citrix Netscaler or similar device. Here the TM FC Saas TCP/IP stack fingerprinting techniques have identified the remote device's OS signature as being generated by a Citrix Netscaler, or another type of device which is providing similar TCP/IP normalization to the TCP/IP packets.	false	Mac OS X or iOS
Output	Not in Portal	third_party_cookie	string	A unique value stored inside a browser cookie under the threatmetrix domain.	false	8124b66362f8c03818876150c92964b1
Output	Time Zone	time_zone	integer	The offset in minutes from UTC on the device clock (for standard or winter time, where applicable)	false	60
Output	Time Zone DST Offset	time_zone_dst_offset	integer	The difference in minutes between summer and winter time, if applicable	false	60
Output	Time Zone Offset Anomaly	timezone_offset_anomaly	string	"Yes" if the timezone offset is not an official timezone offset in any country. Customers should use a policy rule to check if the timezone is appropriate for the geographical location of the device (if known).	false	Yes
Output	TMX Reasons	tmx_reason_code	string	The TMX ‘Global’ Policy is a set of rules created by the ThreatMetrix team that is evaluated for all ThreatMetrix customers. The Global Policy runs independently of the customer’s ‘ Local’ policy generating its own policy score, reason codes and summary reason codes. The reason code for the TMX policy is output to the tmx_reason_code field. Please note that as the global policy is subject to change, this attribute must be used with caution within rules. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	TMX Risk Rating	tmx_risk_rating	string	The risk rating as per the TMX policy score.	false	Possible values: high, medium, low, neutral, trusted
Output	TMX Policy Score	tmx_policy_score	integer	The score output which is the sum of all risk weights from triggered rules within the Global Policy.	false
Output	TMX Summary Reasons	tmx_summary_reason_code	string	The summary reason codes generated by the TMX policy which triggered the rules.The summary reason codes generated by the TMX Global policy which triggered the rules. The summary reason code is used for the easy identification of a set of rules by using a common summary field for them. Please note that as the global policy is subject to change, this attribute must be used with caution within rules. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	Device_Spoofing
Output	Variables	tmx_variables	string	Lists all variables calculated by the Smart Rules Analytics engine in JSON format. This is a premium feature and will only be returned for customers using Smart Rules.	false	_SMART_ID_LCL_AGE_LT_HR _DIG_ID_LCL_AGE_LT_HR _TEST_DIG_ID_LCL_AGE_LT_HR
Output	Third Party Error	tps_error	string	This appears only when there is a third party error such as "Could not resolve 'http://www.unknownhost.com'" , "404 Error - server busy" etc.	false	Could not resolve 'http://www.unknownhost.com"
Output	Third Party Result	tps_result	string	Indicates the result of performing the Third Party Check.	false	yes/no/fail/timeout - normalized result by threatmetrix yes - the third party service check passed (e.g. address validation was successfully called and and the vendor "passed" the supplied address) no - the third party service check did not pass (e.g. address validation was successfully called, but the vendor "failed" the supplied telephone number as it was not connected (for example)) fail - some kind of error occurred when calling the 3rd party service (e.g. insufficient attributes, or http connection refused) timeout - the duration of the 3rd party call exceeded the configured timeout period and the results of the call were not available at the time of ThreatMetrix rule processing
Output	Third Party Vendor Error	tps_vendor_error	string	The Third Party vendor error code. See error_detais for error particulars	false	ex "2208: Invalid Search Criteria"
Output	Third Party Vendor Match Codes	tps_vendor_result	string	In case of successful response without timeout : comma delimited match codes.	false	ex AT,G In case of timeout : empty
Output	Third Party Timeout	tps_was_timeout	string	Indicates if the Third Party service call exceeded the configured timeout period.	false	Yes/No
Output	Third Party Datetime	tps_datetime	timestamp	The date and time that the call to the service was initiated in the format: yyyy-mm-dd HH:MM:SS.mmm	false	2018-09-03 00:10:37.123
Output	Third Party Duration	tps_duration	integer	This is the total time taken to process the request, in milliseconds	false
Input, Output	Transaction Amount	transaction_amount	float	This is the value of the transaction denominated in the transaction_currency. Maximum value is 999 999 999 999 999.99.	false
Input, Output	Authorization Amount	transaction_auth_amount	float	Indicates if the dollar value of the credit card authorization in the denominated currency is different from Value Amount (e.g. $1 pre-auth could be used that does not represent the full value of the transaction or for recurring payments, AUTH amount would be the value of the present subscription). Maximum value is 999 999 999 999 999.99.	false
Input, Output	Authorization Currency	transaction_auth_currency	string	This is the currency that the authorization was denominated in. Currency type is validated and a reason code is generated if the type is incorrectly denoted (_TMX_INVALID_TRANSACTION_AUTH_CURRENCY). For the currencies that have more than 2 decimal places, and only those, we allow the full number of decimal places. See https://www2.1010data.com/documentationcenter/beta/1010dataUsersGuide/DataTypesAndFormats/currencyUnitCodes.html for currencies that accept more than 2 decimal places.	false
Input, Output	Transaction Currency	transaction_currency	string	This is the currency that the transaction was denominated in. Currency type is validated and a reason code is generated if the type is incorrectly denoted (_TMX_INVALID_TRANSACTION_CURRENCY). For the currencies that have more than 2 decimal places, and only those, we allow the full number of decimal places. See https://www2.1010data.com/documentationcenter/beta/1010dataUsersGuide/DataTypesAndFormats/currencyUnitCodes.html for currencies that accept more than 2 decimal places.	false
Input, Output	Transaction ID	transaction_id	string	This is a local identifier used by the merchant to identify the transaction e.g. purchase order number.	false
Input, Output	Ship Amount	transaction_shipping_amount	float	This is the value/cost of shipping broken out separately. Maximum value is 999 999 999 999 999.99	false
Input, Output	Ship Currency	transaction_shipping_currency	string	This is the currency that the transaction was denominated in. Currency type is validated and a reason code is generated if the type is incorrectly denoted (_TMX_INVALID_TRANSACTION_SHIP_CURRENCY). For the currencies that have more than 2 decimal places, and only those, we allow the full number of decimal places. See https://www2.1010data.com/documentationcenter/beta/1010dataUsersGuide/DataTypesAndFormats/currencyUnitCodes.html for currencies that accept more than 2 decimal places.	false
Output	True IP	true_ip	inet	The true client IP Address detected by ThreatMetrix.	false
Output	True IP Local Trust Tags	true_ip_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_CHALLENGE_PASSED
Output	True IP Global Trust Tags	true_ip_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_TRUSTED_CONF
Output	True IP City	true_ip_city	string	The city that the True IP is located in.	false	San Jose
Output	True IP First Seen	true_ip_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2019-02-14
Output	True IP Geo	true_ip_geo	string	The 2 character ISO2 country code of the True IP Address.	false	US
Output	True IP ISP	true_ip_isp	string	The ISP that the True IP address originates from.	false
Output	True IP Last Event	true_ip_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2019-02-14
Output	True IP Last Update	true_ip_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2019-02-14
Output	True IP Assertion History	true_ip_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	True IP Last Assertion	true_ip_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2019-02-14
Output	True IP Latitude	true_ip_latitude	float	The latitude of the True IP.	false
Output	True IP Longitude	true_ip_longitude	float	The longitude of the True IP.	false
Output	True IP Organization	true_ip_organization	string	The organization that the True IP address originates from.	false
Output	True IP Result	true_ip_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	True IP Score	true_ip_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false
Output	True IP Worst Score	true_ip_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false
Output	True IP Region	true_ip_region	string	The region or state of the IP Address	false	California
Output	True IP Region Code	true_ip_region_iso_code	string	The 2 letter ISO code for States for the United States and Canada	false	CA
Output	UA Agent	ua_agent	string	The agent, parsed from the http user agent / "browser" string, which indicates the client may not be a real browser, e.g. crawler.	false
Output	UA Browser	ua_browser	string	The browser type, parsed from the http user agent / "browser" string.	false	firefox 53.0
Output	UA Mobile	ua_mobile	string	The mobile device flag, parsed from the http user agent / "browser" string.	false	Yes/No
Output	UA OS	ua_os	string	The operating system type, parsed from the http user agent / "browser" string.	false	macosx
Output	UA Platform	ua_platform	string	The platform type, parsed from the http user agent / "browser" string.	false	firefox 53.0
Output	UA Proxy	ua_proxy	string	The proxy flag, parsed from the http user agent / "browser" string.	false	yes/no
Input, Output	Custom Unencrypted 1	unencrypted_condition_attrib_1	string	Input parameters that are available in condition rules, but not in velocity rules. These are not encrypted and should not contain any PII data.	false
Input, Output	Custom Unencrypted 2	unencrypted_condition_attrib_2	string	Input parameters that are available in condition rules, but not in velocity rules. These are not encrypted and should not contain any PII data.	false
Output	Unknown Page Differences	unknown_page_diff	string	The actual page differences listed.	false
Output	Unknown Session	unknown_session	string	Indicates if the profiling attributes were not collected for the queried session (otherwise not present).	false	yes/no
Output	URL Anomaly	url_anomaly	string	If the request host is not the host we configured, this flag will be set to Yes. For now, only Flash can detect this feature.	false	yes/no
Input, Output	Not in Portal	verification_credential	string	The user entered credential used for verification against the SMS code sent to the user.	false	Example: 443567
Output	Session ID Query Count	session_id_query_count	integer	Records the number of Session Query API Calls made against a unique Session ID. It is designed to aid in the detection of bot attacks / session replays where the same Session ID is continually being referenced at profiling time.	false	1
Output	Javascript OS	js_os	string	The operating system as detected via JavaScript.	false	Mac OS X 10.12
Output	Javascript Browser	js_browser	string	The browser as detected via JavaScript.	false	Firefox 53
Output	Javascript Browser String Hash	js_browser_string_hash	string	An MD5 hash of the browser string.	false	8b520d9b7a2d522aa06894039842a333
Output	Browser	browser	string	The browser determined using a combination of Flash, JavaScript and User Agent. This is normalized and set to one of the values in the Example column. If browser detection was unsuccessful this will be set to Unknown. If a browser is detected that is not one of the normalized values it will be set to Other.	false	Internet Explorer, Edge, Chrome, FireFox, Safari, Opera, Opera Mini, Unknown, Other
Output	OS Version	os_version	string	The operating system version determined using a combination of a ThreatMetrix executable agent (TrustDefender), Flash, JavaScript and User Agent. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false	10.12.5
Output	Browser Anomaly	browser_anomaly	string	This attribute will be returned with a value of 'yes' if an anomaly is detected with the various browser attributes collected during profiling, including Flash, JavaScript and User Agent.	false	Yes
Output	Agent Profiling Delta	agent_profiling_delta	integer	ThreatMetrix SDK: time taken, in milliseconds, for the SDK to perform device profiling. TrustDefender Client: time taken, in milliseconds, for the security health assessment. This includes only the time required for the on-device evaluation, and not network latency to ThreatMetrix profiling servers.	false	1238
Output	Smart Learning Risk Rank	smart_learning_risk_rank	float	The percentile where the Smart Learning policy score falls based on the population score distribution, ranging from 0-100. The higher the percentile, the higher the risk. This is recommended for decision making.	false	91
Output	Smart Learning Fraud Rating	smart_learning_fraud_rating	string	The smart_learning_p_score grouping based on predetermined fixed ranges.	false	very_high, high, medium, low, very_low
Output	Smart Learning Policy Score	smart_learning_policy_score	integer	The score from the Smart Learning policy execution ranging from -100 to 100. The higher the score, the lower the risk.	false	20
Input, Output	Input Latitude	input_Latitude	float	The Latitude of the end user which is inputted by the customer during the Session Query.	false	48.067531
Input, Output	Input Longitude	input_longitude	float	The Longitude of the end user which is inputted by the customer during the Session Query.	false	12.863365
Input, Output	API Version	api_version	float	The Version of the ThreatMetrix API. This can be passed during Session Query API calls to obtain attributes only for a specific version. The API Version column denotes the API Version for each attribute. If a value is not passed in the API, all attributes will be returned.	false	8.3
Output	Agent BSSID	agent_bssid	string	The BSSID the device was connected to during profiling.	false	6c:70:9f:e2:6e:ab
Output	Not in Portal	flash_guid	uuid	An ID assigned by flash which is stored on the's device.	false	9c7e79b04b054c11945e55e7451ca098
Output	Smart Learning Variables	smart_learning_variables	JSON encoded string	Lists all variables calculated by the Smart Learning policy in JSON format.	false
Output	Smart Learning Reasons	smart_learning_reason_code	string	The Smart Learning policy runs independently of the customer’s ‘ Local’ policy generating its own policy score, reason codes, and summary reason codes. These reason codes from the Smart Learning policy are output to this field.	false
Output	Smart Learning Summary Reasons	smart_learning_summary_reason_code	string	The Summary Reason Codes from the Smart Learning policy is output to this field, if any.	false
Input, Output	Segment Name	segment_name	string	The Segment applied by the A-B Testing Segment Rule during policy execution.	false	Segment A
Output	HTML Location Latitude	html_location_latitude	float	The accuracy rating, in meters, of the location collected during the HTML Geolocation API via Web Profiling.	false	E.g: 145.22554548
Output	HTML Location Longitude	html_location_longitude	float	The accuracy rating, in meters, of the location collected during the HTML Geolocation API via Web Profiling.	false	E.g: -37.82465426
Output	HTML Location Accuracy	html_location_accuracy	float	The accuracy rating, in meters, of the location collected during the HTML Geolocation API via Web Profiling.	false	E.g: 5.43
Output	HTML Location Altitude	html_location_altitude	float	Altitude (height), in meters, above the location collected via the HTML Geolocation API during Web Profiling. If the altitude is not available, the value of this attribute will be null.	false	E.g: 122.5
Output	HTML Location Heading	html_location_heading	float	Travel direction, in degrees, where 0° = heading < 360°, counting clockwise relative to true north, collected via the HTML Geolocation API during Web Profiling. If the altitude is not available, the value of this attribute will be null.	false	E.g: 46.03
Output	Account Email Domain	account_email_domain	string	The domain of the email address passed into the Account Email Attribute.	false	gmail.com
Input, Output	Account Date of Birth	account_date_of_birth	date	Account Date of Birth in YYYYMMDD format	false	19800103
Input, Output	Customer Event Type	customer_event_type	string	The sub event type that is customer specific.	false	create
Input, Output	Application Name	application_name	string	The application name that represents the application sending the event.	false	TMX
Input, Output	Line of Business	line_of_business	string	The Line of Business as specified by the customer	false	Marketing
Output	Carrier Name	carrier_name	string	The name of the Mobile Network Operator.	false	E.g: ATT
Output	Carrier Mobile Number	carrier_mobile_number	string	The Carrier Mobile Number is an obfuscated value relating to the mobile phone number of the profiled device. This is derived using data provided from the mobile network operator.	false
Output	Carrier Mobile Number Local Trust Tags	carrier_mobile_number_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_CHALLENGE_PASSED
Output	Carrier Mobile Number Global Trust Tags	carrier_mobile_number_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	TRUSTED_CONF
Output	Carrier Mobile Number Last Event	carrier_mobile_number_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-15
Output	Carrier Mobile Number Match Result	carrier_mobile_number_match_result	string	The result of the match for Carrier ID: success - identified as a known device new_device - identified as a new device	false	success/new_device
Output	Carrier Mobile Number Last Update	carrier_mobile_number_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-15
Output	Carrier Mobile Number Score	carrier_mobile_number_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false	0
Output	Carrier Mobile Number Assertion History	carrier_mobile_number_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	CONFIRMED_GOOD
Output	Carrier Mobile Number Last Assertion	carrier_mobile_number_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-08-15
Output	Carrier Mobile Number First Seen	carrier_mobile_number_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2019-02-14
Output	Carrier Mobile Number Result	carrier_mobile_number_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Carrier Mobile Number Worst Score	carrier_mobile_number_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false
Output	Carrier Account	carrier_account	string	The Carrier Account number is an obfuscated value relating to the account number of subscriber's account with the mobile network operator. This is derivedusing data provided from the mobile network operator. Entity	false
Output	Carrier Account Local Trust Tags	carrier_account_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	CONFIRMED_BAD CONFIRMED_GOOD
Output	Carrier Account Global Trust Tags	carrier_account_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	NEGATIVE_HISTORY_LAST_ACTIVITY_AGE
Output	Carrier Account Last Event	carrier_account_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-15
Output	Carrier Account First Seen	carrier_account_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-15
Output	Carrier Account Match Result	carrier_account_match_result	string	The result of the match for Carrier ID: success - identified as a known device new_device - identified as a new device	false	success/new_device
Output	Carrier Account Last Update	carrier_account_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-15
Output	Carrier Account Score	carrier_account_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false	20
Output	Carrier Account Worst Score	carrier_account_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false	-25
Output	Carrier Account Assertion History	carrier_account_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE
Output	Carrier Account Result	carrier_account_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Carrier Account Last Assertion	carrier_account_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-08-15
Output	Private Browsing	private_browsing	string	This attribute will be set to Yes if Private Browsing mode (Also known as Incognito or InPrivate mode) is enabled in the web browser. This implies that cookies for this session will not be persistent, and the ThreatMetrix Exact ID will be regenerated for this and future Private Browsing mode sessions. It is recommended to evaluate the cookie-less Smart ID attribute to aid in device detection for sessions where Private Browsing is enabled.	false	Yes
Output	Case Id	case_id	string	An identification number for the Case which uniquely distinguishes it.	false	A00415
Output	Case Status	case_status	string	The Case Status indicates whether the case is Open or Closed.	false	Open
Input, Output	Queue	queue	string	The name of the queue; a queue is a container for cases.	false	High Value
Input, Output	Assignee	assignee	string	The assignee to whom a case is assigned. This can be an individual user or “system".	false	bsmith@company.com
Output	WebGL Hash	webgl_hash	string	The device fingerprint generated by WebGL which is a hashed value of multiple properties, elements and plugins based on the browser/platform combinations and device capabilities. Only gathered via Javascript web profiling, not SDK.	false	4cf4f5def4ec0cbb3609d0d8f1f8bce50d881144
Output	Account Address Postal Code Latitude	account_address_zip_latitude	float	The latitude obtained by geocoding the location of the account address ZIP.	false
Output	Account Address Postal Code Longitude	account_address_zip_longitude	float	The longitude obtained by geocoding the location of the account address ZIP.	false
Output	Shipping Address Zip Latitude	shipping_address_zip_latitude	float	The latitude obtained by geocoding the location of the shipping address ZIP.	false
Output	Shipping Address Zip Longitude	shipping_address_zip_longitude	float	The longitude obtained by geocoding the location of the shipping address ZIP.	false
Output	Targeted Malware	targeted_malware	string	Contains a comma separated list of detected malware variants. The format is family_variant_detection, for example: Ramnit_967503_2 is the Ramnit trojan, the variant is an identifier for the configuration used by the trojan ( internal identifier), the detection number is a particular detection technique (also an internal number)	false	Ramnit_967503_2
Output	Local IPv4	local_ipv4	string	Web: not populated. Android SDK: local IPv4 address of the currently connected interface (E.g. WiFi or Cellular) iOS SDK: comma separated list of all local IPv4 addresses (E.g. WiFi and Cellular) OSX SDK: comma separated list of all local IPv4 addresses (E.g. WiFi and Cellular) Windows SDK: not populated.	false	Android: 10.0.1.14:wlan0 iOS: [10.0.1.39 : en0,10.5.246.16 : pdp_ip0,169.254.20.222 : en2] OS X : [10.0.1.22 : en0,10.100.128.110 : utun1,192.168.0.47 : en4]
Output	Local IPv6	local_ipv6	string	The local IPv6 (Internet Protocol Version 6) populated from the SDK. It includes the IPv6 and network interface name. It may return multiple IPv6. Web: not populated. Android SDK: local IPv6 address of the currently connected interface (E.g. WiFi or Cellular). iOS SDK: comma separated list of all local IPv6 addresses (E.g. WiFi and Cellular). OSX SDK: comma separated list of all local IPv4 addresses (E.g. WiFi and Cellular). Windows SDK: not populated.	false	Android: fe80::e632:cbff:feed:7420:wlan0 iOS: [fe80::454:f60c:97a5:a4b : en2,fe80::8c70:b4fb:293c:c17c : utun0,fe80::c24:76fc:947d:49e2 : en0,fe80::d878:f4ff:fe30:9000 : awdl0] OS X: [fd3d:43c8:1aa7:9d7e:5b84:83e7:5850:7c17 : bbptp0,fe80::1891:b5ff:fe06:1ca5 : bbptp0,fe80::494:9886:fc6e:52a1 : en4,fe80::9875:8fff:fe18:646b : awdl0,fe80::a299:9bff:fe15:d98b : utun1,fe80::a6e3:484e:2b8f:698e : utun1,fe80::abbb:5b2f:6973:118f : utun0,fe80::c7d:baee:40f2:f42f : en0]
Output	MAC Address	mac_address	string	Android: The list of all the available MAC addresses ( wlan : Wireless network rmnet : Tethering or cellular p2p : peer to peer connection dummy : the local loopback) iOS SDK: not populated OSX SDK: not populated Windows SDK: not populated	false	02:32:cb:ed:74:20:p2p0, 06:d4:e1:f1:da:59:rev_rmnet4, 0e:6e:37:80:6e:e0:dummy0, 9a:0f:6a:df:5f:d2:rev_rmnet0, 9e:19:93:05:17:e3:rev_rmnet3, a6:c6:37:60:4a:aa:rmnet_smux1, a6:ea:fb:03:7d:c6:rev_rmnet2, b2:22:18:f4:a9:26:rmnet_smux0, e4:32:cb:ed:74:20:wlan0, ea:ea:0b:35:bc:87:rev_rmnet1
Output	Page Fingerprint Diff Names	page_fingerprint_diff_names	string	Multiple comma separated names, same format as page_fingerprint_diff	false
Output	Honeypot Fingerprint Diff Names	honeypot_fingerprint_diff_names	string	Multiple comma separated names, same format as page_fingerprint_diff	false
Output	Flash Version Detected	flash_version_detected	string	The version of Flash detected by querying specific Flash capabilities. Aids with the detection of browser spoofing.	false	10,11,12,13,14,15,16,17,18, 19,20,21,22,23,24,25,26
Output	DNS IP Hosting Facility	dns_ip_hosting_facility	string	Determines whether the connection originated at a facility that provides storage, computing or telecommunication services.	false	Yes
Output	DNS IP Connection Type	dns_ip_connection_type	string	Users can connect to the Internet in several different ways. IP Intelligence identifies connections by these types.	false	tx
Output	DNS IP Postal Code	dns_ip_postal_code	string	The postal code assigned to the corresponding city of the IP Address.	false	2066
Output	Proxy IP Hosting Facility	proxy_ip_hosting_facility	string	Determines whether the connection originated at a facility that provides storage, computing or telecommunication services.	false	Yes
Output	Proxy IP Connection Type	proxy_ip_connection_type	string	Users can connect to the Internet in several different ways. IP Intelligence identifies connections by these types.	false	dsl
Output	Proxy IP Line Speed	proxy_ip_line_speed	string	Indicates the speed of the connection to the Internet, divided into: high, medium, or low. This information is determined by the Connection Type.	false	Low
Output	Proxy IP Postal Code	proxy_ip_postal_code	string	The postal code assigned to the corresponding city of the IP Address.	false	2066
Output	Proxy IP Routing Type	proxy_ip_routing_type	string	Specifies how the connection is routed through the Internet and can be used to determine how close the user is to the public IP address.	false	Fixed
Output	Input IP Hosting Facility	input_ip_hosting_facility	string	Determines whether the connection originated at a facility that provides storage, computing or telecommunication services.	false	Yes
Output	Input IP Connection Type	input_ip_connection_type	string	Users can connect to the Internet in several different ways. IP Intelligence identifies connections by these types.	false	dsl
Output	Input IP Line Speed	input_ip_line_speed	string	Indicates the speed of the connection to the Internet, divided into: high, medium, or low. This information is determined by the Connection Type.	false	High
Output	Input IP Postal Code	input_ip_postal_code	string	The postal code assigned to the corresponding city of the IP Address.	false	2066
Output	True IP Hosting Facility	true_ip_hosting_facility	string	Determines whether the connection originated at a facility that provides storage, computing or telecommunication services.	false	Yes
Output	True IP Connection Type	true_ip_connection_type	string	Users can connect to the Internet in several different ways. IP Intelligence identifies connections by these types.	false	dsl
Output	True IP Line Speed	true_ip_line_speed	string	Indicates the speed of the connection to the Internet, divided into: high, medium, or low. This information is determined by the Connection Type.	false	High
Output	True IP Postal Code	true_ip_postal_code	string	The postal code assigned to the corresponding city of the IP Address.	false	2066
Output	True IP Routing Type	true_ip_routing_type	string	Specifies how the connection is routed through the Internet and can be used to determine how close the user is to the public IP address.	false	Fixed
Output	Agent Connection Type	agent_connection_type	string	The type of connection in use during profiling: WiFi or Cellular.	false	WIFI
Output	Account Home Phone	account_home_phone	string	The home telephone number associated with the account. Please note that this field is NOT an entity.	false
Output	Account Work Phone	account_work_phone	string	The work telephone number associated with the account. Please note that this field is NOT an entity.	false
Output	Account Address Postal Code Normalized	account_address_zip_normalized	string	The normalized account address ZIP to support geocoding lookups.	false	2066
Output	Shipping Address Postal Code Normalized	shipping_address_zip_normalized	string	The normalized shipping address ZIP to support geocoding lookups.	false	2067
Output	WebRTC Internal IP	webrtc_internal_ip	inet	The internal (local) IP Address of the profiled device obtained via WebRTC. Only gathered via Javascript web profiling, not SDK.	false	192.168.1.4
Output	WebRTC External IP	webrtc_external_ip	inet	The external IP Address of the profiled device obtained via WebRTC. This is only gathered via Javascript web profiling, not SDK.	false	155.21.72.192
Output	WebRTC IPv6	webrtc_ipv6	string	The external IP Address of the profiled device obtained via WebRTC. This is only gathered via JavaScript web profiling, not SDK. It may include both internal and external IPv6. This has been updated to the WebRTC External IPv6. This could be multiple IPv6 address with ',' as a limiter.	false	155.21.72.192
Output	Canvas Hash	canvas_hash	string	The device fingerprint generated by HTML Canvas Fingerprinting. This hashed value is based on the color pixels in a canvas where different OS+browser combinations will tend to have different pixels in terms of color and dpi. Only gathered via Javascript web profiling, not SDK.	false	0733d13f4873dbcaf32de893a856371f04e71000
Output	App Integrity Score	app_integrity_score	integer	The confidence score between 1 and 1000 that indicates the likelihood of the app not being tampered with.	false	1000
Input, Output	Custom Number 5	custom_count_5	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_5", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 6	custom_count_6	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_6", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 7	custom_count_7	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_7", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 8	custom_count_8	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_8, this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 9	custom_count_9	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_9", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 10	custom_count_10	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_10", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 11	custom_count_11	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_11", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 12	custom_count_12	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_12", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 13	custom_count_13	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_13", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 14	custom_count_14	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_14", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Number 15	custom_count_15	float	If 'Output_Count_To' parameter is configured for a rule and equals "custom_count_15", this parameter is returned to the customer. Value of this parameter is a count, exact sense of that count is rule specific.	false
Input, Output	Custom Output 11	custom_output_11	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as Input in the Condition rule.	false
Input, Output	Custom Output 12	custom_output_12	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as Input in the Condition rule.	false
Input, Output	Custom Output 13	custom_output_13	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as Input in the Condition rule.	false
Input, Output	Custom Output 14	custom_output_14	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as Input in the Condition rule.	false
Input, Output	Custom Output 15	custom_output_15	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as Input in the Condition rule.	false
Input, Output	Custom Output 16	custom_output_16	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as Input in the Condition rule.	false
Input, Output	Custom Output 17	custom_output_17	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as Input in the Condition rule.	false
Input, Output	Custom Output 18	custom_output_18	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as Input in the Condition rule.	false
Input, Output	Custom Output 19	custom_output_19	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as Input in the Condition rule.	false
Input, Output	Custom Output 20	custom_output_20	string	A custom field for storing the value of attributes in Persona ID Rules; may be used as Input in the Condition rule.	false
Output	UA OS Alternative	ua_os_alt	string	The Operating System as found by an alternative detection source.	false	android, win8.1, ios, macosx, win10, win7, winvista
Output	UA OS Version Alternative	ua_os_version_alt	string	The version of the browser as found by an alternative detection source.	false	android 6.0.1, windows 8.1, iOS 6.1.2, mac OS X 10.7.5, etc.
Output	Virtual Device	virtual_device	integer	Detects whether a mobile device is running in an Emulator on Android, or a Simulator on iOS. This stores a numerical value that indicates the number of emulator/simulator elements on a device. Null or 0 indicates that there were no elements detected. Any value higher than 0 indicates that the device is most likely running via a simulator/emulator.	false	1
Output	Virtual Device Reason	virtual_device_reason	string	A semicolon separated string containing additional information that describes the element(s) on the device that triggered the virtual machine detection.	false	id://phone?15555215554;prop://ro.hardware?generic_x86;prop://ro.product.board?nox;prop://ro.bootloader?nox;file:///ueventd.android_x86.rc;file:///ueventd.android_x86.rc;
Output	DNS IP Assertion History	dns_ip_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	SUSPICIOUS
Output	DNS IP Global Trust Tags	dns_ip_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_AUTH_FAILED
Output	DNS IP Local Trust Tags	dns_ip_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Input, Output	Primary Industry	primary_industry	string	The primary industry associated with the event.	false	Banking
Input, Output	Secondary Industry	secondary_industry	string	The secondary industry associated with the event.	false	Brokerage
Input, Output	Ship Address Matches Bill Address	ship_address_is_bill_address	string	This is a yes/no flag indicating that the shipping and billing addresses match.	false	yes
Output	Authenticated Message	strong_auth_signature	string	The strong_auth_signature is a "hex encoded PKCS7 SignedData in a ContentInfo as defined in RFC 2315 "Cryptographic Message Syntax Version 1.5". It is signed by the Strong ID private key in the case of "tmxdevicepresence".	false	3082019506092a864886f70d010702a082018630820182020101310f300d06096086480165030402010500301f06092a864 886f70d010701a01204107468697320697320612070726f6d707431820149308201450201013053304b3149304706035504 030c40303466383939366461373633623761393639623130323865653330303735363965616633613633353438366464616 23231316435313263383562396466386662020459b87311300d06096086480165030402010500a08185301806092a864886 f70d010903310b06092a864886f70d0107013018060a2a864886f70d01091903310a04080aaa6ae06e200b9d301e06092a8 64886f70d0109153111040f746d787573657270726573656e6365302f06092a864886f70d010904312204203ad746624cf7 25492ae41a042b35f307582bee1b2ae188c2920b8acd934c153c300a06082a8648ce3d040302044830460221008c6a0b99b d3804dba03ea80c5de7f3083fbb0e4e15012df88404158e2274a5aa022100f7c6be0532c58cce7190103669d20090bc260a 1f2e3716f71c45682e592a3fe6
Input, Output	Authentication Method	auth_methods	string	The authentication method: "tmxdevicepresence". More authentication methods will be supported in the future.	false	tmxdevicepresence
Output	Authentication Status	auth_status	string	Indicates the status of the authentication which may be: auth_success, auth_fail, auth_init, or auth_init_in_progress.	false	auth_success
Output	Authentication Certificate	strong_auth_certificate	string	Not applicable for the currently supported authentication method, "tmxdevicepresence". Available in future versions for other methods.	false
Output	Authentication Status Reason	auth_status_reason	string	This is displayed in the event of an auth_fail indicating the reason for failure, such as "user cancel" or "challenge response failed".	false	user cancel
Output	Not in Portal	auth_devices	string	A JSON struct of devices and autheticators bound to a user context and available for strong authentication.	false	auth_devices contains the following information: device_nickname: the human readable name of the device. device_model: the human readable model of the device. device_os: the operating system of the device. auth_methods: the authentication method which is: "tmxdevicepresence". registration_timestamp: the time of registration. device_id: the Public key information used for verifying a device's identification, that combined with a device's secure hardware (TEE/Secure Enclave), forms a strong identification link. authenticator_id: Tokenized Public key information used for verifying a device's identification, that combined with a device's secure hardware (TEE/Secure Enclave), forms a strong identification link. Note: the auth_device_id field will continue to be supported for backward compatibility.
Input, Output	Merchant Category Code	merchant_category_code	integer	A Merchant Category Code (MCC) is a four-digit number listed in ISO 18245 for retail financial services.	false	2015
Input, Output	Merchant Country Code	merchant_country_code	string	The ISO 3166-1 alpha-2 value corresponding to the merchant's country code.	false	AU
Input, Output	Merchant Name	merchant_name	string	This is a free text field for entering a Merchant Name which may be up to 40 characters in length.	false	XYZ1Merchant
Input, Output	Merchant ID	merchant_id	string	This is a free text field for entering a Merchant ID which may be up to 40 characters in length.	false
Output	Device Health Reasons	device_health_reasons	array	The Device Health Reasons attribute consolidates all device health related attributes for ThreatMetrix Mobile under a single category. See the KB's article "Device Health Reasons Attribute" for more information.	false	CLONED NOT CLONED COULD NOT CHECK JB ROOT REASON DEVELOPER MODE (SDK 5.4+,CHROME)
Input, Output	LexID Digital	digital_id	string	A LexID Digital is a number that represents a person's identity. It's represented as a 32-digit hex number. It's generated from the various entities (account name, account address, account telephone, etc.) that have been associated together in events.	false
Output	LexID Digital Confidence	digital_id_confidence	integer	The confidence score returned signifies the level of confidence that the event appears to be matching the behavior from the returned LexID Digital. 0 is returned when the event results into the generation of a new digitalID. 10000 is returned when there is a 100% match A value below 25% (2500) should be interpreted as very low confidence A value about 70% (7000) generally indicates high confidence	false	4060
Output	LexID Digital Global Trust Tags	digital_id_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_AUTH_FAILED
Output	LexID Digital Local Trust Tags	digital_id_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	LexID Digital First Seen	digital_id_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-04-07
Output	LexID Digital Last Event	digital_id_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-04-07
Output	LexID Digital Last Update	digital_id_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-04-07
Output	LexID Digital Result	digital_id_result	string	The result indicates the following:"new_digital_id": There was no LexID Digital match and a new one was created. "not_enough_attribs": Not enough data was passed to match or create a LexID Digital. "success": An existing LexID Digital was matched.	false	success/new_digital_id/not_enough_attribs
Output	Silverlight Guid	silverlight_guid	uuid	A unique value stored inside a Silverlight local store.	false	9c7e79b04b054c11945e55e7451ca098
Output	Screen Resolution Alt	screen_dpi	integer	The Dots Per Inch (screen DPI) for the screen display.	false	96
Input, Output	API	tps_type	string	The type of service provided by the Third Party Vendor.	false	emailagevalidator
Input, Output	TPS Vendor	tps_vendor	string	The name of the Third Party vendor	false	IDV-email
Output	TPS Vendor Raw Response	tps_vendor_raw_response	string	The raw response body from the Third Party Vendor	false	1794431165id.partialPARTIAL RESULT - REQUIRES ATTENTIONresult.matchID Locatedresultcode.newer.record.foundNewer Record Foundresultcode.low.riskLow Risk Score50
Output	Device Model	device_model	string	Human readable model of the device.	false	nexus 9
Output	Not in Portal	device_name	string	Human readable name of the device.	false	"Bob's phone"
Output	Agent Publickey	agent_publickey	string	The public key generated via Strong ID. This is not available in the portal.	false
Output	Agent Public Key Hash	agent_publickey_hash	string	Public key information used for verifying a device's identification, that combined with a device's secure hardware (TEE/Secure Enclave), forms a strong identification link.	false
Output	Agent Public Key Hash Local Trust Tags	agent_publickey_hash_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_CHALLENGE_PASSED
Output	Agent Public Key Hash Global Trust Tags	agent_publickey_hash_attributes	string	The Global Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	TRUSTED_CONF
Output	Agent Public Key Hash Last Event	agent_publickey_hash_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-08-15
Output	Agent Public Key Hash Last Update	agent_publickey_hash_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2017-08-15
Output	Agent Public Key Hash Score	agent_publickey_hash_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false	0
Output	Agent Public Key Hash Assertion History	agent_publickey_hash_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	CONFIRMED_GOOD
Output	Agent Public Key Hash Last Assertion	agent_publickey_hash_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2017-08-15
Output	Agent Public Key Hash First Seen	agent_publickey_hash_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2019-02-14
Output	Agent Public Key Hash Result	agent_publickey_hash_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Agent Public Key Hash Worst Score	agent_publickey_hash_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false
Input, Output	Advertising ID	advertising_id	string	A unique, user-resettable identifier for advertising targeting.	false
Output	Device IMEI	device_imei	string	The IMEI of the mobile device.	false	01-234567-890123-4
Input, Output	Notes	notes	string	Optional field to enter additional details about the event during an api call.	false
Output	Not in Portal	summary_risk_score	integer	Same as the policy score. Deprecated.	false	50
Output	UA Browser Alternative	ua_browser_alt	string	The browser as found by an alternative detection source.	false	chrome 52.0, android 4.0, firefox 46.0, android webview, 4.0, safari 6.0, etc.
Output	UA Browser Version Alternative	ua_browser_version_alt	string	The version of the browser as found by an alternative detection source.	false	android webkit 6.0.1, chrome 40.0.2214.111, chromium 52.0.2743.98, facebook on android 6.0.1, firefox 46.0, mobile safari 9.2, IE 11.0, etc.
Output	SeLinux Status	selinux_status	string	Indicator of whether Security-Enanced Linux has been enforced on an Android phone. Only populated if true.	false	permissive, permissive, enforcing, unknown
Input	Event Tag	event_tag	string	The contextual tag applied via the Update API that describes the final outcome of the event.	false	fraud_confirmed trusted_confirmed fraud_probably trusted_probably challenge_init challenge_fail challenge_pass
Output	Custom Attribute 1 Local Trust Tags	local_attrib_1_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 2 Local Trust Tags	local_attrib_2_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 3 Local Trust Tags	local_attrib_3_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 4 Local Trust Tags	local_attrib_4_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 5 Local Trust Tags	local_attrib_5_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 6 Local Trust Tags	local_attrib_6_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 7 Local Trust Tags	local_attrib_7_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 8 Local Trust Tags	local_attrib_8_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 9 Local Trust Tags	local_attrib_9_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 10 Local Trust Tags	local_attrib_10_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 11 Local Trust Tags	local_attrib_11_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 12 Local Trust Tags	local_attrib_12_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 13 Local Trust Tags	local_attrib_13_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 14 Local Trust Tags	local_attrib_14_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 15 Local Trust Tags	local_attrib_15_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_REJECTED
Output	Custom Attribute 1 First Seen	local_attrib_1_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 2 First Seen	local_attrib_2_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 3 First Seen	local_attrib_3_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 4 First Seen	local_attrib_4_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 5 First Seen	local_attrib_5_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 6 First Seen	local_attrib_6_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 7 First Seen	local_attrib_7_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 8 First Seen	local_attrib_8_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 9 First Seen	local_attrib_9_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 10 First Seen	local_attrib_10_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 11 First Seen	local_attrib_11_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 12 First Seen	local_attrib_12_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 13 First Seen	local_attrib_13_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 14 First Seen	local_attrib_14_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Output	Custom Attribute 15 First Seen	local_attrib_15_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-08-08
Input, Output	Web Session ID	web_session_id	string	The inputted Web Session ID that represents a session for a user in a customers website/mobile application. Please note that the TTL for this entity is 1 day only.	false
Output	Web Session ID Local Trust Tags	web_session_id_activities	string	The Local Trust Tags for this entity. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false	_TRUSTED
Input, Output	Web Session ID Last Update	web_session_id_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2019-02-14
Output	Web Session ID First Seen	web_session_id_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2017-04-07
Output	Web Session ID Last Event	web_session_id_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2017-04-07
Output	Challenger Policy	challenger_policy	string	The name of the challenger policy.	false	Login_challenger
Output	Challenger Policy Score	challenger_policy_score	integer	The policy score of the challenger policy which is calculated based on the sum of the risk weights for each of the rules configured within it.	false	20
Output	Challenger Reasons	challenger_reason_code	string	The names of rules from the challenger policy that have triggered. Each rule name is returned as a separate name/value pair. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	Challenger Risk Rating	challenger_risk_rating	string	The risk mapped according to challenger policy score.	false	Low
Output	Challenger Summary Reasons	challenger_summary_reason_code	string	The summary reason codes generated by the challenger policy which triggered the rules. The summary reason code is used for the easy identification of a set of rules by using a common summary field for them. There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	Challenger Review Status	challenger_review_status	string	The status mapped according to challenger policy score.	false
Output	LexID Digital Confidence Rating	digital_id_confidence_rating	string	A textual description which is indicative of the "band" in which the confidence score belongs.	false
Output	Profile API Time Delta	profile_api_timedelta	integer	The difference in milliseconds between the first attribute reaching the profiling server and the time the API request is made. Portal only Attribute, not in the API.	false
Input	Not in Portal	additional_data	string	This field is used to contain any additional notes from the analyst.	false
Input	Not in Portal	analyst_email	string	Optional email address of the analyst reviewing the transaction. Email address is not validated.	false	bob@example.com
Input	API Key	api_key	string	An API Key is a string of characters that is used to validate the API Calls made by a customer to the ThreatMetrix Platform. Each customer is issued one API Key when first acquiring solutions from ThreatMetrix. An API Key is unique and associated with an Org ID. If a customer has multiple Org IDs, E.g. one for testing an one for production then each Org ID will have a differing API Key.	false	325euk66x0lckl7j
Output	Not in Portal	external_guid	string	A pseudo device-cookie provided by 3DS API/areq (GUID).	false
Output	Not in Portal	global_third_party_cookie	string	A Third party http cookie created via the ThreatMetrix Profilingdomain (GUID).	false
Input, Output	ThreeD Secure Completion Indicator	threeds_comp_ind	string	Single char value mapped from Areq:threeDSCompInd.	false
Output	Targeted Storage	targeted_storage	string	Browser Keys	false
Output	Not in Portal	turn_os_sig_ttl	integer	TTL of TURN gathered from the webrtc connection.	false	58
Output	Turn Os Signature	turn_os_signature	string	Detected OS of TURN gathered from webrtc connection.	false	Mac OS X or iOS
Output	Turn System State	turn_system_state	integer	TCP system state of TURN gathered from webrtc connection.	false	1524622019
Output	Not in Portal	turn_tcp_tstmp_rate	integer	Timestamp rate of TURN gathered from webrtc connection.	false	1000
Internal Attribute	Internal Attribute	experiment_1	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_2	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_3	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_4	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_5	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_6	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_7	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_8	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_9	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_10	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_mobile_1	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_mobile_2	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_mobile_3	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_mobile_4	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_mobile_5	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_mobile_6	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_mobile_7	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_mobile_8	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_mobile_9	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Internal Attribute	Internal Attribute	experiment_mobile_10	Internal Attribute	Internal Attribute for testing purposes. Subject to change and not recommended for use.	false	Internal Attribute
Output	Not in Portal	policy_details_api	JSON encoded string	JSON object containing policy execution information.	false
Output	LexID Digital Trust Score Rating	digital_id_trust_score_rating	string	Trust Score rating associated with the ThreatMetrix ID which may be one of the following: very_low, low, neutral, high, very_high	false	high
Output	LexID Digital Trust Score Reasons	digital_id_trust_score_reason_code	string	Reason codes describing the Trust Score rating (mutiple values). There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	Not in Portal	integration_hub_results	JSON encoded string	A structured JSON object containing multiple integration hub results.	false
Output	Agent SSID	agent_ssid	string	Hash (SHA1) of the SSID the device was connected to during profiling.	false
Output	Not in Portal	apprep_selfhash_sha256	hex ascii	The hex encoded sha256 hash of the host mobile application that is using the SDK.	false
Output	SSL FP Signature	ssl_fp_signature	MD5 hex ascii value	MD5 formatted Signature of the client application profiled by the ThreatMetrix profiling server.	false
Output	SSL FP Client	ssl_fp_client	string	Name of the client application profiled by the ThreatMetrix profiling server.	false
Output	SSL FP Category	ssl_fp_category	string	Category of the client application profiled by the ThreatMetrix profiling server.	false
Output	LexID Digital Reasons	digital_id_reason_code	string	Reason codes describing the LexID Digital (multiple values). There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Output	LexID Digital Summary Reasons	digital_id_summary_reason_code	string	Reason codes providing a summary of the LexID Digital (multiple values).	false
Output	LexID Digital Trust Score Summary Reasons	digital_id_trust_score_summary_reason_code	string	Reason codes providing a summary of the Trust Score rating (multiple values). There may be up to 64 characters per entry and there may be an unlimited number of entries.	false
Input	Not in Portal	national_id_type	string	There are four valid National ID types. US_SSN and US_SSN_HASH will create entities. US_SSN4 and US_SSN_FIRST5 will not create entities. US_SSN and US_SSN_HASH. Depending on whether you pass in US_SSN or US_SSN hash, the national_id_number format required will change. US_SSN4: When selected, the validation will enforce 4 digits on the national_id_number attribute. US_SSN_FIRST5: When selected, the validation will enforce 5 digits on the national_id_number attribute.	false
Input	Not in Portal	national_id_number	string	If national_id_type is US_SSN, then national_id_number must be exactly 9 digits. If national_id_type is US_SSN_HASH, then the national_id_number must be SHA-256 Hash of the Social Security Number. If national_id_type is US_SSN4, the validation will enforce 4 digits on the national_id_number attribute. If national_id_type is US_SSN_FIRST5, the validation will enforce 5 digits on the national_id_number attribute. US_SSN and US_SSN_HASH will create entities.	false
Output	Not in Portal	national_id_activities	string	The Local Trust Tags for this entity.	false
Output	Not in Portal	national_id_assert_history	string	The Global Trust Tags for this entity.	false
Output	Not in Portal	national_id_attributes	string	Entity attributes for national_id	false
Output	Not in Portal	national_id_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2019-02-14
Output	Not in Portal	national_id_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2019-02-14
Output	Not in Portal	national_id_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2019-02-14
Output	Not in Portal	national_id_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2019-02-14
Output	Not in Portal	national_id_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Not in Portal	national_id_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false
Output	Not in Portal	national_id_worst_score	integer	The lowest score ever reached by this entity between 0 (neutral) and -100 (high risk).	false
Output	Device IMEI Local Trust Tags	device_imei_activities	string	The Local Trust Tags for this entity.	false	_LOGIN_PASSED
Output	Device IMEI Global Trust Tags	device_imei_attributes	string	The Global Trust Tags for this entity.	false	_LOGIN_PASSED
Output	Device IMEI First Seen	device_imei_first_seen	date	The date that this entity was first encountered by ThreatMetrix, in yyyy-mm-dd format.	false	2018-10-10
Output	Device IMEI Last Event	device_imei_last_event	date	The date of the last event/transaction made by this entity, in yyyy-mm-dd format.	false	2018-10-10
Output	Device IMEI Last Update	device_imei_last_update	date	The date that the record for this entity was last updated, in yyyy-mm-dd format.	false	2018-10-10
Output	Device IMEI Result	device_imei_result	string	"not found" indicates this is the first time ThreatMetrix has seen this entity involved in a transaction; "success" indicates that ThreatMetrix has intelligence on this entity.	false	success/not found
Output	Device IMEI Score	device_imei_score	integer	The risk score between +100 (minimum to low risk) and -100 (maximum to high risk).	false	5
Output	Device IMEI Last Assertion	device_imei_last_assertion	date	The date the last assertion for this entity was made, in yyyy-mm-dd format.	false	2018-10-10
Output	Device IMEI Assertion History	device_imei_assert_history	string	The assertion history for this entity based on attribute assertion calls. This field may contain one of these possible values: SUSPICIOUS CONFIRMED_BAD CONFIRMED_GOOD NEGATIVE_HISTORY LAST_ACTIVITY_AGE.	false	SUSPICIOUS
Output	Agent Boot Time	agent_boot_time	date	The date and time since the device was booted. This is a Portal only attribute.	false	2018-10-10
Output	Agent Image Creation	agent_image_creation	integer	The date and time that the OS image on the agent was created, expressed in seconds since Midnight January 1, 1970—Unix time. This is a Portal only attribute.	false	1521030275
Output	CPU Cores	cpu_cores	integer	Indicates the number of central processing unit (CPU) cores that were detected.	false	1, 2, 4, 8, etc.
Input, Output	Input IPv6	input_ipv6_address	string	The IPv6 address (Internet Protocol version 6) inputted by the customer. This is passed by the customer in anAPI call. The API then validates it as one valid IPv6 address. The IPv6 address must be a valid external address. If an invalid external IPv6 address is passed into the transaction, the value is removed from the transaction. The Event Detail Reasons for the transaction will then reflect INVALID_input_ipv6_address.	false	Android: fe80::e632:cbff:feed:7420:wlan0 iOS: [fe80::454:f60c:97a5:a4b : en2,fe80::8c70:b4fb:293c:c17c : utun0,fe80::c24:76fc:947d:49e2 : en0,fe80::d878:f4ff:fe30:9000 : awdl0] OSX: [fd3d:43c8:1aa7:9d7e:5b84:83e7:5850:7c17 : bbptp0,fe80::1891:b5ff:fe06:1ca5 : bbptp0,fe80::494:9886:fc6e:52a1 : en4,fe80::9875:8fff:fe18:646b : awdl0,fe80::a299:9bff:fe15:d98b : utun1,fe80::a6e3:484e:2b8f:698e : utun1,fe80::abbb:5b2f:6973:118f : utun0,fe80::c7d:baee:40f2:f42f : en0]
Output	DNS IPv6	dns_ipv6	string	The IPv6 address of the Domain Name System (DNS) server. It is one valid IPv6 address. This is NOT yet implemented.	false	Android: fe80::e632:cbff:feed:7420:wlan0 iOS: [fe80::454:f60c:97a5:a4b : en2,fe80::8c70:b4fb:293c:c17c : utun0,fe80::c24:76fc:947d:49e2 : en0,fe80::d878:f4ff:fe30:9000 : awdl0] OSX: [fd3d:43c8:1aa7:9d7e:5b84:83e7:5850:7c17 : bbptp0,fe80::1891:b5ff:fe06:1ca5 : bbptp0,fe80::494:9886:fc6e:52a1 : en4,fe80::9875:8fff:fe18:646b : awdl0,fe80::a299:9bff:fe15:d98b : utun1,fe80::a6e3:484e:2b8f:698e : utun1,fe80::abbb:5b2f:6973:118f : utun0,fe80::c7d:baee:40f2:f42f : en0]
output	WebRTC External IPv6	webrtc_external_ipv6	string	The external IPv6 Address of the profiled device obtained via WebRTC with profiling. This is only gathered via JavaScript web profiling, not SDK. It is one valid IPv6 address. This is NOT yet implemented.	false	Android: fe80::e632:cbff:feed:7420:wlan0 iOS: [fe80::454:f60c:97a5:a4b : en2,fe80::8c70:b4fb:293c:c17c : utun0,fe80::c24:76fc:947d:49e2 : en0,fe80::d878:f4ff:fe30:9000 : awdl0] OSX: [fd3d:43c8:1aa7:9d7e:5b84:83e7:5850:7c17 : bbptp0,fe80::1891:b5ff:fe06:1ca5 : bbptp0,fe80::494:9886:fc6e:52a1 : en4,fe80::9875:8fff:fe18:646b : awdl0,fe80::a299:9bff:fe15:d98b : utun1,fe80::a6e3:484e:2b8f:698e : utun1,fe80::abbb:5b2f:6973:118f : utun0,fe80::c7d:baee:40f2:f42f : en0]
output	WebRTC Internal IPv6	webrtc_internal_ipv6	string	The internal (local) IPv6 Address of the profiled device obtained from JavaScript via WebRTC. Only gathered via JavaScript web profiling, not SDK. This could be multiple IPv6 address with ',' as a limiter.	false	Android: fe80::e632:cbff:feed:7420:wlan0 iOS: [fe80::454:f60c:97a5:a4b : en2,fe80::8c70:b4fb:293c:c17c : utun0,fe80::c24:76fc:947d:49e2 : en0,fe80::d878:f4ff:fe30:9000 : awdl0] OSX: [fd3d:43c8:1aa7:9d7e:5b84:83e7:5850:7c17 : bbptp0,fe80::1891:b5ff:fe06:1ca5 : bbptp0,fe80::494:9886:fc6e:52a1 : en4,fe80::9875:8fff:fe18:646b : awdl0,fe80::a299:9bff:fe15:d98b : utun1,fe80::a6e3:484e:2b8f:698e : utun1,fe80::abbb:5b2f:6973:118f : utun0,fe80::c7d:baee:40f2:f42f : en0]
output	True IPv6	true_ipv6	string	The true client IPv6 Address detected by ThreatMetrix as one valid IPv6 address.	false	Android: fe80::e632:cbff:feed:7420:wlan0 iOS: [fe80::454:f60c:97a5:a4b : en2,fe80::8c70:b4fb:293c:c17c : utun0,fe80::c24:76fc:947d:49e2 : en0,fe80::d878:f4ff:fe30:9000 : awdl0] OSX: [fd3d:43c8:1aa7:9d7e:5b84:83e7:5850:7c17 : bbptp0,fe80::1891:b5ff:fe06:1ca5 : bbptp0,fe80::494:9886:fc6e:52a1 : en4,fe80::9875:8fff:fe18:646b : awdl0,fe80::a299:9bff:fe15:d98b : utun1,fe80::a6e3:484e:2b8f:698e : utun1,fe80::abbb:5b2f:6973:118f : utun0,fe80::c7d:baee:40f2:f42f : en0]
output	Proxy IPv6	proxy_ipv6	string	If available, the IPv6 address of the proxy as one valid IPv6 address.	false	Android: fe80::e632:cbff:feed:7420:wlan0 iOS: [fe80::454:f60c:97a5:a4b : en2,fe80::8c70:b4fb:293c:c17c : utun0,fe80::c24:76fc:947d:49e2 : en0,fe80::d878:f4ff:fe30:9000 : awdl0] OSX: [fd3d:43c8:1aa7:9d7e:5b84:83e7:5850:7c17 : bbptp0,fe80::1891:b5ff:fe06:1ca5 : bbptp0,fe80::494:9886:fc6e:52a1 : en4,fe80::9875:8fff:fe18:646b : awdl0,fe80::a299:9bff:fe15:d98b : utun1,fe80::a6e3:484e:2b8f:698e : utun1,fe80::abbb:5b2f:6973:118f : utun0,fe80::c7d:baee:40f2:f42f : en0]
Output	Timezone Name	timezone_name	string	The name for a given Time Zone.	false	Pacific/Auckland
Output	VM Index	vm_index	integer	Confidence score to determine whether a PC is actually a Virtual Machine (VM). The higher the score, the more likely it is a VM.	false	0 to 1000
Output	Multiple Displays	multi_display	string	Detects whether more than one display (monitor) was found.	false	True
Output	GPU Vendor	gpu_vendor	string	The vendor of GPU as detected by WebGL.	false	ATI Technologies Inc.
Output	GPU Name	gpu_name	string	The type of GPU as detected by WebGL.	false	AMD Radeon Pro 560X OpenGL Engine
Output	CPU Clock Speed	cpu_clock	string	The speed of CPU clock as detected by javascript.	false	5000.0 MHZ
Output	Device Memory	device_memory	integer	Amount of system RAM detected on the device (max 8GB).	false	1, 2, 4, or 8
Output	VM Reason	vm_reason	string	Reasons why a device was flagged as being a potential virtual machine (relates to vm_index).	false	cpu_cores, cpu_clock, device_memory, os_anomaly, gpu_vendor, mutli_display
Output	Settlement Amount USD	settlement_amount_usd	float	The settlement_amount converted to USD using the current day's exchange rates obtained from openexchange.org. These numbers are updated every day.	false
Output	Transaction Amount USD	transaction_amount_usd	float	The transaction_amount converted to USD using the current day's exchange rates obtained from openexchange.org. These numbers are updated every day.	false
Output	Authorization Amount USD	transaction_auth_amount_usd	float	The transaction_auth_amount converted to USD using the current day's exchange rates obtained from openexchange.org. These numbers are updated every day.	false
Output	Ship Amount USD	transaction_shipping_amount_usd	float	The transaction_shipping_amount converted to USD using the current day's exchange rates obtained from openexchange.org. These numbers are updated every day.	false
Input	Profile Org ID	profile_org_id	string	The profile_org_id is used in special instances where multiple org_ids share the same profiling session information, and is required to identify the profiling session.	false
Output	Smart Learning P Score	smart_learning_p_score	float	The output from the Smart Learning regression function ranging from 0–1. The higher the value, the higher the risk.	false	0.011
Output	App Update Time	app_mod_time	timestamp	The timestamp when an app is modified (updated) on the mobile device.	false	1556081061
Output	App Install Time	app_install_time	timestamp	The timestamp when an app was installed (first seen) on the mobile device.	false	1556079378
Output	agent_battery_status	agent_battery_status	JSON encoded string	Device battery status as a JSON string	false	"{\"level\": 0.53,\"status\":\"Unplugged\"}"
Output	Not in Portal	agent_publickey_hash_type	string	The type of the key pair used for StrongID. The private key is stored on the remote device and the public key is used in the generation of the hash. This involves the storage method on the remote device (on secure hardware is ”strong,” on obfuscated format is “soft,” and in a browser with an indexDB entry is “web”) and the type of key digital signature algorithm (RSA or ECDSA). If the remote device sent Strong ID parameters but verification failed, it will be “invalid,” which is evidence of either malicious activity or a bug in the implementation or integration. Apart from the “invalid” response, agent_publickkey_hash_type is a description of the key used to generate—and is found alongside—agent_publickkey_hash and agent_publickey.	false	strong:ecdsa, soft:ecdsa, web:ecdsa, strong:rsa, soft:rsa, web:rsa, invalid
Output	Smart Learning Challenger Policy Score	smart_learning_challenger_policy_score	integer	The score from the Smart Learning challenger policy execution ranging from -100 to 100. The higher the score, the lower the risk.	false	20
Output	Smart Learning Challenger Reason Code	smart_learning_challenger_reason_code	string	The Smart Learning challenger policy runs independently of the customer’s ‘ Local’ policy generating its own challenger policy score, challenger reason codes, and challenger summary reason codes. These reason codes from the Smart Learning challenger policy are output to this field.	false
Output	Smart Learning Challenger Risk Rank	smart_learning_challenger_risk_rank	float	The percentile where the Smart Learning challenger policy score falls based on the population challenger score distribution, ranging from 0-100. The higher the percentile, the higher the risk.	false	7
Output	Smart Learning Challenger Summary Reason Code	smart_learning_challenger_summary_reason_code	string	The Summary Reason Codes from the Smart Learning challenger policy is output to this field, if any.	false
Output	Smart Learning Challenger Fraud Rating	smart_learning_challenger_fraud_rating	string	The smart_learning_challenger_p_score grouping based on predetermined fixed ranges.	false	very_high, high, medium, low, very_low
Output	Smart Learning Challenger P Score	smart_learning_challenger_p_score	float	The output from the Smart Learning regression function of the challenger policy ranging from 0–1. The higher the value, the higher the risk.	false
Output	Audio Context	audio_context	string	Hash of the AudioContext fingerprint as detected based on the OS & browser being used.	false	D8E7873399A39764DACE6C307128210DC144D194A4A746DA9BE3CF66281455A4
Output	Math Routine	math_routine	string	Hash of the OS & Browser as detected by math routine computation.	false	5DFB948F998C9DA1962722A57BBEB1C1E8C81661E1EBF39364A2AEE7CBA98FD6
Output	Battery Status	battery_status	string	Battery statistics as detected via javascript; includes charging status, and percentage remaining. Supported on Chrome only.	false	{"level":1.00,"status":"Unplugged"}
Output	Media Devices	webrtc_media	string	Number of media devices as discovered by WebRTC. (AudioInput, VideoInput, AudioOutput)	false
Output	Multiple Displays	multi_display	Boolean	Detects whether more than one display (monitor) was found.	false	TRUE
Output	Browser Addon Hash	browser_addon_hash	string	Lists the name of what browser add-ons were detected to generate the browser_addon_hash	false	16A0708FDD57B8D3E647C8B197EE79A453B7130A90E37DF6BE9A4EAFA5750F6E
Output	Browser Addons	browser_addon	string	Hashed value detailing what browser add-ons were discovered in the users browser	false	AdBlock Plus, Random UserAgent, HTTPS Everywhere
Input, Output	Account Telephone Geo	account_telephone_geo	string	The ISO 3166-1 alpha-2 value corresponding to the account telephone's country code.	false	AU
Input, Output	Account Telephone Country Code	account_telephone_country_code	integer	The international digit(s) when dialing the phone number internationally. Note: EXCLUDING the + char.	false	. +1 USA would be 1 +61 AUS would be 61 etc.
Input	Account Drivers License Issuer	account_drivers_license_issuer	string	The issuer of the account drivers license.	false
Input	Account Drivers License Type	account_drivers_license_type	string	The type of drivers license	false
Input	Account Passport Country	account_passport_country	string	The ISO 3166-1 alpha-2 value corresponding to the account passport's country code.	false	US
Input	Account Passport Issue Date	account_passport_issue_date	string	Date the passport was issued.	false
Input	Account Passport Expiration Date	account_passport_expiration_date	string	Date the passport expires.	false
Output	Warning Reason Code	warning_reason_code	string	A warning reason_code that indicates an error.	false	INVALID_account_email
Output	Paste Detected	paste_detected	JSON encoded string	Reports that a paste was detected via Behavioral Biometrics.	false
Output	Remote Access	remote_access	string	Reports method used to detect a remote desktop instance via Behavioral Biometrics.	false
Output	Keyboard Analytics	keyboard_analytics	JSON encoded string	Reports keyboard analytics collected via Behavioral Biometrics.	false
Output	Mouse Analytics	mouse_analytics	JSON encoded string	Reports mouse analytics collected via Behavioral Biometrics.	false
Input, Output	Event Datetime	event_datetime	timestamp	An attribute to pass a timestamp so that an event is processed as though it occurred at a time in the past. Must be in YYYY-MM-DD HH:mm:SS format	false	2019-01-31 13:56:33
Input	Batch ID	batch_id	string	ID used to identify groups of transactions processed within the same batch	false	Alphanumeric with hyphen/underscore/period etc AB-232344-393-23
Input	Batch Sequence Number	batch_sequence_number	string	Sequence Number/Reference Number used to identify a transactions within the same batch.	false	Alphanumeric with hyphen/underscore/period etc 001283.343A
Input	Integration ID	integration_id	string	An identifier for partners and system integrators to track events coming from their platforms.	false	Alphanumeric with hyphen, underscore, period, etc.
Input	Batch Total Amount	batch_total_amount	float	The sum of the transaction amounts for all transactions within the batch. Used by customers to calculate each transaction as a percentage of the batch.	false	Numeric currency with 0, 2, or 3 decimal places of accuracy as required for the currency
Input	Batch Total Currency	batch_total_currency	char 3	The currency in which the batch_total_amount was provided.	false	ISO 3 alpha currency code
Output	Batch Total Amount USD	batch_total_amount_usd	float	The value of batch_total_amount, converted to US dollars, at the daily exchange rate.	false	Total of the batch in USD to 2 decimal places
Output	VPN Detected Score	vpn_score	integer	This score aggregates multiple VPN methods into a single score. The higher the score, the more likely that VPN is in use.	false	0 to 1000
Output	VPN Detected Reason	vpn_reason	string	Provides a list of factors that were used in deriving the vpn_score attribute.	false	MSS_Size, MTU_Path, Mobile_OS, IP_List
Output	SDK Battery Status	agent_battery_status	string	Device battery status as a JSON string.	false	"{\"level\": 0.53,\"status\":\"Battery Power\"}"
Output	Connection Protocol	profile_connection_type	string	Indicates the connection protocol used for device profiling.	false	SSLv3, TLS 1.2, etc.
Output	Browser Spoofing Score	browser_spoof_score	integer	Score indicating the likelihood that a user is spoofing their browser type.	false	0 to 1000
Output	Browser Spoofing Reason	browser_spoof_reason	string	Reason codes detailing what information contributes to the browser_spoof score.	false
Input	Account Telephone Context	account_telephone_context	string	Provides the context of the account_telephone for the primary account holder.	false	Must be one of the following values: home business mobile fax pager other
Input	Account Gender	account_gender	char 3	Gender of the primary account holder	false	Male, Female, Unknown
output	Android Remote Desktop	droid_rd	Boolean	Indicates the presence of remote desktop client apps installed on an Android device.	false	true/false
Output	Android Remote Desktop Reason	droid_rd_reason	string	Provides the name of the remote desktop client app detected on an Android device.	false	VNC Client, Teamviewer, etc
Output	Web Accessibility	web_accesibility	Boolean	Indicates whether accessibility persmission are enabled in the browser.	false	true/false
Output	Remote Access Score	remote_access_score	integer	This score aggregates multiple remote desktop detection methods into a single score. The higher the score, the more likely that remote desktop / remote access is in use. This score ranges from 0 to 1000 and indicates the likelihood that remote access is in use via Behavioral Biometrics.	false	0 to 1000
Output	Mouse Off Page	mouse_offpage	string	Indicates if mouse moved off-page while populating a given page or text field.	false
Output	Behavioral Biometrics Bot Score	bb_bot_score	float	This score ranges from 0 to 1000 and indicates the likelihood that the system is being accessed by a bot. Scores from 1 to 499 indicate user is likely human (lower is less risky). Scores from 501 to 1000 indicate user is possible bot (higher is more risky). Scores of 500 are considered neutral or insufficient data was available.	false	0.00 to 1000.00
Output	Behavioral Biometrics Fraud Score	bb_fraud_score	float	This score ranges from 0 to 1000 and indicates the probability that the user is a fraudster. The score is derived using a proprietary machine learning algorithm that analyzes the raw data collected during device profiling. Examples of the signals that would be used to compute this include the use of keyboard shortcuts, the amount of time spent on a page, and the use of paste.	false	0.00 to 1000.00
Output	Behavioral Biometrics Fraud Reason	bb_reason_code	string	Reason code indicating why the Behavioral Biometrics score was computed as it was.	false
Input/Output	Not in Portal	account_passport_machine_readable_line1	string	Passport machine readable line 1 (encrypted). Character '<' may be present in the value.	false
Input/Output	Not in Portal	account_passport_machine_readable_line2	string	Passport machine readable line 2 (encrypted). Character '<' may be present in the value.	false
Output	HTTP Advertised MSS	http_os_sig_adv_mss	integer	The mss value from tcp_info. tcpi_advmss.	false
Output	HTTP OS Raw Signature	http_os_sig_raw	string	If the http_os_signature was indeterminate, this string contains the raw signature information.	false
Output	HTTP Received MSS	http_os_sig_rcv_mss	integer	The mss value from tcp_info.tcpi_rcv_mss.	false
Output	InstantID.Conversation ID	instantid_conversation_id	integer	Unique identifier that is assigned to the transaction by LexisNexis Services. Recommended: Map Conversation ID in External API call to resolve any support issues with LexisNexis Services.	false	31000001655662
Input/Output	Account LexID	account_lex_id	string hashed PII	Lex ID of the primary account. This value is output by a given rule and is passed as an input attribute to subsequent LexisNexis® insights rules. Unique identifier that is assigned to a subject by LexisNexis. A LexID number does not include any sensitive, personally identifying information.	false	123456789
Input/Output	Account LexID Region	account_lex_id_region	string	The region that the LexID belongs to (Currently US,GB)	false	US or GB
Output	InstantID.CVI Score	instantid_cvi	integer	The CVI (comprehensive verification index) is a risk verification index summarizing the verification matches that are found in the NAS summary and NAP summary. The results of the NAS and NAP verification levels are summarized in the CVI with a six level indicator with discrete values of 00, 10, 20, 30, 40, and 50. A higher value indicates more identity elements have been verified.	false	00: Nothing verified 10 Critical ID elements not verified, are associated with different person(s), or indications such as OFAC matches, deceased/invalid SSN, SSN issued prior to DOB, etc. exist 20: Minimal verification, critical ID elements not verified or associated with different person(s) 30: Several ID elements verified 40: Last name, address and SSN or phone verified; first name, phone or SSN verification failures 50: Full name, address, phone, SSN verified
Output	InstantID.NAS Summary	instantid_name_address_ssn_summary	integer	The NAS (name, address, and Social Security number) summary is an index that summarizes the results of verifying the input first name, last name, residential address, and SSN against the identities on record. Reporting sources include national credit bureau header records, utility source records, and public records. The NAS index returns a value of 0 to 12, where each value corresponds to a defined combination of identity elements verified.	false	0: Nothing found for input criteria 1: Input SSN is associated with a different name and address 2: Input First name and Last Name matched 3: Input First name and Address matched 4: Input First name and SSN matched 5: Input Last name and Address matched 6: Input Address and SSN matched 7: Input Last name and SSN matched 8: Input First name, Last name and Address matched 9: Input First name, Last name and SSN matched 10: Input First name, Address, and SSN matched 11: Input Last name, Address, and SSN matched 12: Input First name, Last name, Address and SSN matched
Output	InstantID.NAP Summary	instantid_nap_summary	integer	The NAP (name, address, and phone number) index summarizes the results of verifying the input first name, last name, residential address, and phone number against reporting sources that provide coverage of these identity elements. Reporting sources include phone directories and utility records and can include contributed inquiry records from LexisNexis® Fraud Defense Network Event Activity data. The NAP index provides very timely updates to name and address verification. The phone number is not required to verify name and address through these sources. The NAP index returns a value of 0 to 12, where each value corresponds to a defined combination of identity elements verified.	false	0: Nothing found for input criteria 1: Input phone is associated with a different name and address 2: First name and Last name matched 3: First name and Address matched 4: First name and Phone matched 5: Last name and Address matched 6: Address and Phone matched 7: Last name and Phone matched 8: First name, Last name, and Address matched 9: First name, Last name, and Phone matched 10: First name, Address, and Phone matched 11: Last name, Address, and Phone matched 12: First name, Last name, Address, and Phone matched
Output	InstantID.Risk Indicators Values	instantid_risk_indicators_values	Array of strings	A structure that contains risk indicator values. This is not returned in Portal. API Only.	false
Output	InstantID.Risk Indicators Details	instantid_risk_indicators_details	Array of strings	A structure that contains risk indicator details. This is not returned in Portal. API Only.	false
Output	InstantID.Verified Input Full Name	instantid_verified_input_full_name	string hashed PII	Verified Input Full Name. The full name returned by an InstantID verification This attribute is not currently available for use.	false	Sir Reginald Borris Chesterfield Junior
Output	InstantID.Verified Input First Name	instantid_verified_input_first_name	string hashed PII	Verified Input First Name	false	Reginald
Output	InstantID.Verified Input Middle Name	instantid_verified_input_middle_name	string hashed PII	Verified Input Middle Name. This attribute is not currently available for use.	false	Borris
Output	InstantID.Verified Input Last Name	instantid_verified_input_last_name	string hashed PII	Verified Input Last Name	false	Chesterfield
Output	InstantID.Verified Input Prefix Name	instantid_verified_input_prefix_name	string hashed PII	Verified Input Prefix Name This attribute is not currently available for use.	false	Mr, Mrs, Sir
Output	InstantID.Verified Input Suffix Name	instantid_verified_input_suffix_name	string hashed PII	Verified Input Suffix This attribute is not currently available for use.	false	Jr, Sr
Output	InstantID.Verified Input Street Pre Direction	instantid_verified_input_street_pre_direction	string hashed PII	Verified input pre-direction (as in cardinal directions)	false	SW NE
Output	InstantID.Verified Input Street Post Direction	instantid_verified_input_street_post_direction	string hashed PII	Verified Post direction (as in cardinal directions)	false	N W
Output	InstantID.Verified Input Unit Designation	instantid_verified_input_unit_designation	string hashed PII	Verified input unit designation (for example, Apt and Suite)	false	Apt Suite
Output	InstantID.Verified Street Number	instantid_verified_input_street_number	string hashed PII	Verified input street number	false	123
Output	InstantID.Verified Street Name	instantid_verified_input_street_name	string hashed PII	Verified input street name returned by the Instant ID rule evaluation	false	example
Output	InstantID.Verified Input Street Suffix	instantid_verified_input_street_suffix	string hashed PII	Verified input street suffix (returned by instant id rule evaluation) - eg "st", "rd", "ave"	false	St Rd Ave
Output	InstantID.Verified Input Street Address 1	instantid_verified_input_street_address1	string hashed PII	Verified input Street Address 1. E.g. 123 example st	false	123 example St
Output	InstantID.Verified Input Street Address 2	instantid_verified_input_street_address2	string hashed PII	Verified input street address 2 This attribute is not currently available for use.	false
Output	InstantID.Verified Input Unit Number	instantid_verified_input_unit_number	string hashed PII	Verified input unit number	false	4
Output	InstantID.Verified Input Postal Code	instantid_verified_input_postal_code	string hashed PII	Verified input Postal code (if applicable) This attribute is not currently available for use.	false
Output	InstantID.Verified Input State	instantid_verified_input_state	string hashed PII	Verified input State (USA)	false	GA
Output	InstantID.Verified Input City	instantid_verified_input_city	string hashed PII	Verified input City. City returned by the InstantID evaluation	false	Alpharetta
Output	InstantID.Verified Input City State Zip	instantid_verified_input_state_city_zip	string hashed PII	InstantID verified input state city zip. This attribute is not currently available for use.	false
Output	InstantID.Verified Input Zip5	instantid_verified_input_zip5	string hashed PII	5 digit zip code returned by the InstantID evaluation - eg 90210	false	5 Digits - e.g. 90210
Output	InstantID.Verified Input Zip4	instantid_verified_input_zip4	string hashed PII	4 digit zip code returned by the InstantID evaluation (in applicable)	false	4 Digits - e.g. 9021
Output	InstantID.Verified Input County	instantid_verified_input_county	string hashed PII	Verified input county (e.g. San Mateo)	false	San Mateo
Output	InstantID.Verified Input Latitude	instantid_verified_input_longitude		Longitude of the address evaluated by executing the InstantID rule This attribute is not currently available for use.	false	37.33406
Output	InstantID.Verified Input Longitude	instantid_verified_input_latitude		Longitude of the address evaluated by executing the InstantID rule This attribute is not currently available for use.	false	-121.89207
Output	InstantID.Verified Input Delivery Point Barcode	instantid_verified_input_delivery_point_barcode	string hashed PII	12- digit delivery point bar code of the verified address If the address cannot be standardized based on USPS guidelines, the 12-digit code is not returned.	false	12345678912
Output	InstantID.Verified Input Home Phone	instantid_verified_input_home_phone	string hashed PII	Home phone returned by the InstantID evaluation of the Primary person	false	1234873231
Output	InstantID.Verified Input DOB	instantid_verified_input_dob	string hashed PII	Concatenation of YR + MTH + DAY as YYYY-MM-DD - components not verified will be X's e.g XXXX-02-XX where only the month was verified	false
Output	InstantID.Verified Input DOB Year	instantid_verified_input_DOB_year		Year of birth of the account primary subject	false	1985
Output	InstantID.Verified Input DOB Month	instantid_verified_input_DOB_month		Month of birth of the account primary subject	false	9
Output	InstantID.Verified Input DOB Day	instantid_verified_input_DOB_day		Day of birth of the account primary subject	false	10
Output	InstantID.Verified Input Driver License Number	instantid_verified_input_drivers_license_number	string hashed PII	Verified Input Driver LicenseNumber This attribute is not currently available for use.	false	999999
Output	InstantID.Verified Input SSN	instantid_verified_input_ssn	string hashed PII	Verified input SSN of the primary subject	false	999-99-9999
Output	InstantID.SSN Info Valid	instantid_ssn_info_valid	string	Denotes whether the SSN info provided in the primary account details is valid or not	false	G (Good) M (Manufactured from other data found) S (Suppressed) X (Insufficient information) O (Issued before the subject's DOB) R (Relative’s SSN) F (Typographical error) B (Bad) U (Unknown) Z (Possible different owner)
Output	InstantID.SSN Found For LexID	instantid_ssn_found_for_lex_id	Boolean	Indicates whether an SSN is found in the input individual's LexID record.	false	1 (True), 2 (False)
Output	InstantID.DOB Match Level	instantid_dob_match_level	integer	Confidence level of the match of the input DOB and the DOB that was found for the subject	false	0 (No DOB found or no DOB submitted) 1 (Nothing matches) 2 (Only Day matches) 3 (Only Month matches) 4 (Only Day and Month match) 5 (Only Day and Year match) 6 (Only Year matches) 7 (Only Month and Year match) 8 (Month, Day, and Year match)
Output	InstantID.DOB Verified	instantid_dob_verified	Boolean	Denotes whether the DOB entered as part of the primary subject entered was verified	false	1 (True), 2 (False)
Output	InstantID.NAP Type	instantid_nap_type	string<	Type of data that was used to perform the NAP verification	false	A (PhoneListing) P (Phone records) U (Utilityrecords) S (Customer Network) I (Internal Proprietary)
Output	InstantID.NAP Status	instantid_nap_status	string<	Phone status	false	C (Connected) D (Disconnected)
Output	InstantID.Passport Validated	instantid_passport_validated	Boolean	Indicates whether the passport is validated	false	1 (True), 2 (False)
Output	InstantID.Address Standardized	instantid_address_standardized	Boolean	Indicates whether the information that is returned in the StandardizedInputAddress response structure is standardized (based on USPS guidelines)	false	1 (Information that returned in the StandardizedInputAddress response structure is standardized) 0 (Information that returned in the StandardizedInputAddress response structure failed to standardize)
Output	InstantID.Address CMRA	instantid_address_cmra	Boolean	Indicates whether the address is a CMRA.	false	1 (True), 2 (False)
Output	InstantID.PO Box	instantid_po_box	Boolean	Indicates whether the address is a PO Box.	false	1 (True), 2 (False)
Output	InstantID.Address Secondary Range Mismatch	instantid_address_secondary_range_mismatch	string	Indicates the type of secondary range mismatch between the input address and the address that was found in LexisNexis records.	false	D (No secondary range was submitted, but a secondary range was found in LexisNexis records) I (A secondary range was submitted as input, but a secondary range was not found in LexisNexis records) M (A secondary rank was submitted as input, but the secondary range does not match the secondary range that was found in LexisNexis records) N (No secondary range was submitted as input, and no secondary range was found in LexisNexis records) V (Secondary range was verified, and the input secondary range matche LexisNexis records)
Output	InstantID.Custom CVI Score	instantid_custom_cvi_score	integer	A custom structure that contains custom comprehensive verification score. This allows for the development of customer specific custom scores to be developed and returned within the response in addition to the standard CVI and risk indicator responses.	false	Between 0 and 999
Output	InstantID.Custom Risk Indicators Values	instantid_custom_risk_indicators_values	Array of strings	A custom structure that contains custom risk indicator values. This allows for the development of customer specific custom risk indicators values to be developed and returned within the response in addition to the standard CVI and risk indicator responses.	false	51, MI
Output	InstantID.Custom Risk Indicators Details	instantid_custom_risk_indicators_details	Array of strings	A custom structure that contains custom risk indicator details. This allows for the development of customer specific custom risk indicators details to be developed and returned within the response in addition to the standard CVI and risk indicator responses.	false
Output	InstantID.Transaction Status	instantid_transaction_status	string	Current status of the transaction, the transaction number, and the result of the transaction. Possible values: error, failed, passed, pause, pending.	false	Possible values: error, failed, passed, pause, pending
Output	InstantID.Transaction Reason Code	instantid_transaction_reason_code	string	Identifier that is assigned to the reason for the TransactionStatus.	false
Output	InstantID.Transaction Reason Description	instantid_transaction_reason_description	string	Detailed description for why the failure or error occurred.	false
Output	InstantID.Product Status	instantid_product_status	string	The status of the InstantID product with specific possible values.	false	pass, fail, pending, error, not_enough_data, timed_out, or system_error
Output	Agent SSID Clear	agent_ssid_clear	string	Clear-text name of the wireless access point a mobile device is connected to as detected by Mobile SDK.	false
Output	Field Timing	time_analytics	JSON encoded string	This field used to track the average amount of time & standard deviation that users spend on a text fields. This field is part of Behavioral Biometrics.	false	{ field1_time: 2500, field1_avg:1500, field1_std:500, field2_time: 3500, field2_avg:1000, field2_std:250, field3_time: 4500, field3_avg:1800, field3_std:350, field4_time: 2500, field4_avg:3000, field4_std:450, field5_time: 1500, field5_avg:750, field5_std:500 }
Output	Social Engineering Score	se_score	real	Score indicating the likelihood that an event is a possible social engineering attack. This field is part of Behavioral Biometrics.	false
Output	Social Engineering Reason Code	se_reason	array of strings	Reason code indicating what elements contributed to the social engineering score. This field is part of Behavioral Biometrics.	false
Output	Overall Behavioral Biometrics Score	bb_assessment	real	This is an aggregate score combining multiple different elements to determine the likelihood a transaction is fraudulent. This field is part of Behavioral Biometrics.	false
Output	Profiling Nonce	nonce	string	Profiling nonce.	false	hex encoded random
Input, Output	Condition Attribute 19	condition_attrib_19	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input, Output	Condition Attribute 20	condition_attrib_20	string	Input parameters that are available in condition rules, but not in velocity rules. When using this attribute in a Condition/Expression Condition rule or Expression variable, the value will be treated as string if quotes are used to enclose it and as a number if no quotes are used.	false
Input	Acquirer BIN	acquirer_bin	string	Acquirer Bank Identification Number (BIN)	false
Output	Agent Event Time	agent_event_time		Date and time the Client Session began.	false	2013/03/22-15:38:19 UTC
Output	Agent health Details	agent_health_details	string	Detailed information about the security health that were used to influence the agent_health_status result.	false
Output	Agent Health Status	agent_health_status	integer	A summary of the device's overall security health. Green - the machine is fully compliant with all server-side configuredpolicies relating to antivirus, firewall, os updates, running software etc. Red - malware is present on the device or some other serious securitydeficiency was detected and the device should not be trusted. Yellow - indicates a moderate security issue such as antivirus or firewallsoftware disabled.	false
Output	Agent Session ID	agent_session_id	string	The SSL Session ID of this unique instance of the client authenticatingwith the ThreatMetrix platform.	false
Output	Agent Total Space	agent_total_space	integer	The total storage capacity in bytes of the primary storage in the device.	false
Output	Browser Process	browser_process	string	Name of the web browser process that triggered TrustDefender Client to activate	false
Input	Purchase Date	purchase_date	string	Credit or other Card expiry date in YYMM format.	false
Input	ThreeD Secure Transaction Type	threeds_trans_type	string	Represents the type of purchased item.	false
Input	Card Expiry Date	card_expiry_date	string	The expiration date of the card.	false
Output	Developer Mode	developer_mode	Boolean	Checks to see if developer mode is enabled. Portal Only.	false	True / False
Output	Device IMEI Worst Score	device_imei_worst_score	integer	The worst-ever entity score for device_imei	false	-10
Output	DNS IP Country	dns_ip_country	string	The country associated with the IP address of the DNS server. Portal only.	false
Output	DNS IP Organization Type	dns_ip_organization_type	string	The type of organization associated with dns_ip_organization. Portal only.	false
Output	Drivers License Hash Assertion History	drivers_licence_hash_assert_history	string	Assertion history for this drivers license hash.	false
Output	HTTP Send MSS	http_os_sig_snd_mss	integer	HTTP Maximum Segment Size value from tcp_info.tcpi_snd_mss	false
Output	Installed App Count	apprep_installedapps	string	Number of installed applications on mobile device	false
Output	Password Policy Lock Minutes	pwd_policy_auto_lock_minutes	integer	Windows Only:Windows only: Number of minutes without user input after which the machine will automatically lock.	false
Output	Password Policy Auto Logon	pwd_policy_auto_logon	string	Windows only: Determines if the device is configured to automatically logon without the user entering a password, indicating that they have a saved password configured in the registry	false	Yes, No, Error, Unknown
Output	Password Policy Complexity	pwd_policy_complexity	string	Windows Only: Indicates if the password meets the configured Windows policy setting for complexity, eg: if Enabled the password is complex, if Disabled the password is not complex.	false	Enabled, Disabled, Error, Unknown
Output	Password Policy Enabled	pwd_policy_enabled	string	Windows Only: Does the currently logged on user have a password defined.	false	Yes, No, Error, Unknown
Output	Password Policy Max Days	pwd_policy_max_days	integer	Windows only: Number of days that a password can be used before the system requires the user to change it	false
Output	Password Policy Min Days	pwd_policy_min_days	integer	Windows only: Number of days that a password must be used before the user can change it	false
Output	Password Policy Min Length	pwd_policy_min_length	integer	Windows only: Does the device have a minimum password length specified in the security policy. If so, the minimum length will be returned as a numerical value. If the value is 0 then the user is able to use a password of any length.	false

Flags

ThreatMetrix policies allow the creation of flags that are used during the decision process. The following table defines the default set of flags available using the IdCloud.

Custom policies

The list below is the latest version of our default policy configuration. If your tenant has been customized, or is running a previous version, your setup may differ from the list below.

API/Portal/Report	Availibility	Weight	Type	Invert	Description
true			Condition		API Type is present
Automation		-30.0	Condition		TMX Summary Reason Code equal to Bot
Session Replayed		-30.0	Condition		Multiple Session ID is present
Profiling Failed		-30.0	Condition		Unknown Session is present
Malicious App MITB			Condition		TMX Summary Reason Code equal to MITB
Malicious App Malware			Mobile App Malware Detection		Mobile App Malware Detection
Malicious App		-20.0	IF		Malicious App MITB \| Malicious App Malware
Device Inconsistency Browser			Condition		Browser Anomaly equal to yes
Device Inconsistency UpTime			System State Anomaly		> 2 global day
Device Inconsistency OS			Condition		OS Anomaly equal to yes
Device Inconsistency		-20.0	IF		Device Inconsistency Browser \| Device Inconsistency UpTime \| Device Inconsistency OS
Device Breached			Condition		Jailbreak or Root greater than 0
Device Breached Hidden			Android Root Cloak		Android Root Cloak
Device Spoofed Various			Condition		TMX Summary Reason Code equal to Device_Spoofing
Device Spoofed Emulator			Condition		Virtual Device greater than 0
Device Spoofed		-25.0	IF		Device Spoofed Various \| Device Spoofed Emulator
Location Spoofed		-20.0	Condition		TMX Summary Reason Code equal to GEO_Spoofing
User Spoofed		-15.0	Condition		TMX Summary Reason Code equal to Identity_Spoofing
Language Mismatch Browser/Country			Geo Lang Mismatch		Geo Lang Mismatch
Language Mismatch Browser/Flash			Condition		Browser Language Anomaly is present
Language Mismatch		-10.0	IF		Language Mismatch Browser/Country \| Language Mismatch Browser/Flash
Network Proxy			Condition		Proxy IP is present
Network Private			Condition		TMX Reasons equal to _Known_VPN_ISP
Network Annonymous			Condition		TMX Reasons equal to _T_TOR_TAGGED_7D \| TMX Reasons equal to _T_TOR_TAGGED_90D
Network Remote Access			Condition		Remote Desktop is present
Network Spoofed		-15.0	Condition		TMX Summary Reason Code equal to IP_Spoofing
IP Missing		-1.0	Condition		True IP is absent
IP Mismatch			Condition		True IP not equal to Input IP
IP Discard			Condition		Summary Reason Code equal to IP Discard \| True IP Connection Type contains mobile \| TMX Reasons equal to _Possible VPN or Tunnel
IP Usable			Condition		Reasons not equal to IP Discard & Reasons equal to IP Telecom
Aggregator			Condition		TMX Reasons equal to _Aggregator
Site_Monitoring			Condition		TMX Reasons equal to _Site_monitoring
Cloud_Security_Layer			Condition		TMX Reasons equal to _Cloud_Security_Layer
IP Telecom			Condition		true_ip_organization_type equal to Telecommunications \| true_ip_organization_type equal to Internet Service Provider
IP Cloud		-15.0	Condition		true_ip_organization_type equal to Data Services
IP Mobile			Condition		True IP Connection Type equal to mobile wireless
DNS Google			Condition		DNS IP Organization equal to google
Proxy Modem			Condition		Proxy IP Organization contains dialup \| Proxy IP Organization contains dial up \| Proxy IP Organization contains dial-up \| Proxy IP Organization contains dial-in \| Proxy IP Organization contains dial in \| Proxy IP Organization contains dial-pool
Proxy Hidden		-2.0	Proxy Type Match		Proxy: hidden
Proxy Anonymous		-1.0	Proxy Type Match		Proxy: anonymous
Proxy Transparent			Proxy Type Match		Proxy: transparent
Proxy Public			Proxy Type Match		Proxy: open
Proxy Mobile			Condition		Proxy IP Routing Type is present & Proxy IP Routing Type contains mobile
Cookie Proxy Change 3x 1day Global			Attribute Anomaly		3x Proxy IP / Exact ID global day
Org Mismatch Proxy/IP			Condition		Proxy IP Organization not equal to True IP Organization & Proxy IP Organization is present & True IP Organization is present
ISP Mismatch Proxy/IP			Condition		Proxy IP ISP not equal to True IP ISP & Proxy IP ISP is present & True IP ISP is present
Chall_Pass User-Device 1x 1month		5.0	Trust Tag Check		1x _CHALLENGE_PASSED Account Login & Smart ID LocalOnly all 28_days Updated
Chall_Pass User-Device 1x 6month			Trust Tag Check		1x _CHALLENGE_PASSED Account Login & Smart ID LocalOnly all 6_months Updated
Chall_Pass User-Device 1x 15month			Trust Tag Check		1x _CHALLENGE_PASSED Account Login & Smart ID LocalOnly all 15_months Updated
Chall_Pass User-Device 3x 1month			Trust Tag Check		3x _CHALLENGE_PASSED Account Login & Smart ID LocalOnly all 28_days Updated
Chall_Pass User-Device 3x 6month			Trust Tag Check		3x _CHALLENGE_PASSED Account Login & Smart ID LocalOnly all 6_months Updated
Chall_Pass User-Device 3x 15month			Trust Tag Check		3x _CHALLENGE_PASSED Account Login & Smart ID LocalOnly all 15_months Updated
Chall_Pass User-Device 9x 1month			Trust Tag Check		9x _CHALLENGE_PASSED Account Login & Smart ID LocalOnly all 28_days Updated
Chall_Pass User-Device 9x 6month			Trust Tag Check		9x _CHALLENGE_PASSED Account Login & Smart ID LocalOnly all 6_months Updated
Chall_Pass User-Device 9x 15month			Trust Tag Check		9x _CHALLENGE_PASSED Account Login & Smart ID LocalOnly all 15_months Updated
Fraud_Conf Any 1x 15month		-30.0	Trust Tag Check		1x _FRAUD_CONF All LocalOnly all 15_months Updated
Fraud_Conf Identity 1x 15month			Trust Tag Check		1x _FRAUD_CONF Digital ID LocalOnly all 15_months Updated
Fraud_Conf Device 1x 15month			Trust Tag Check		1x _FRAUD_CONF Smart ID LocalOnly all 15_months Updated
Fraud_Conf Email 1x 15month			Trust Tag Check		1x _FRAUD_CONF Account Email LocalOnly all 15_months Updated
Fraud_Conf Phone 1x 15month			Trust Tag Check		1x _FRAUD_CONF Account Telephone LocalOnly all 15_months Updated
Fraud_Conf User 1x 15month			Trust Tag Check		1x _FRAUD_CONF Account Login LocalOnly all 15_months Updated
Fraud_Conf IP 1x 15month			Trust Tag Check		1x _FRAUD_CONF True IP LocalOnly all 15_months Updated
Auth_Fail Any 1x 15month		-2.0	Trust Tag Check		1x _AUTH_FAILED All LocalOnly all 15_months Updated
Auth_Fail Identity 1x 15month			Trust Tag Check		1x _AUTH_FAILED Digital ID LocalOnly all 15_months Updated
Auth_Fail Device 1x 15month			Trust Tag Check		1x _AUTH_FAILED Smart ID LocalOnly all 15_months Updated
Auth_Fail Email 1x 15month			Trust Tag Check		1x _AUTH_FAILED Account Email LocalOnly all 15_months Updated
Auth_Fail User 1x 15month			Trust Tag Check		1x _AUTH_FAILED Account Login LocalOnly all 15_months Updated
Auth_Fail IP 1x 15month			Trust Tag Check		1x _AUTH_FAILED True IP LocalOnly all 15_months Updated
Auth_Pass Any 1x 15month			Trust Tag Check		1x _AUTH_PASSED All LocalOnly all 15_months Updated
Auth_Pass Identity 1x 15month			Trust Tag Check		1x _AUTH_PASSED Digital ID LocalOnly all 15_months Updated
Auth_Pass Device 1x 15month			Trust Tag Check		1x _AUTH_PASSED Smart ID LocalOnly all 15_months Updated
Auth_Pass Email 1x 15month			Trust Tag Check		1x _AUTH_PASSED Account Email LocalOnly all 15_months Updated
Auth_Pass User 1x 15month			Trust Tag Check		1x _AUTH_PASSED Account Login LocalOnly all 15_months Updated
Auth_Pass IP 1x 15month			Trust Tag Check		1x _AUTH_PASSED True IP LocalOnly all 15_months Updated
Chall_Fail Any 1x 2days			Trust Tag Check		1x _CHALLENGE_FAILED All LocalOnly all 2_days Updated
Chall_Fail Identity 1x 2days			Trust Tag Check		1x _CHALLENGE_FAILED Digital ID LocalOnly all 2_days Updated
Chall_Fail Device 1x 2days		-7.0	Trust Tag Check		1x _CHALLENGE_FAILED Smart ID LocalOnly all 2_days Updated
Chall_Fail Email 1x 2days		-2.0	Trust Tag Check		1x _CHALLENGE_FAILED Account Email LocalOnly all 2_days Updated
Chall_Fail User 1x 2days			Trust Tag Check		1x _CHALLENGE_FAILED Account Login LocalOnly all 2_days Updated
Chall_Fail IP 1x 2days		-3.0	Trust Tag Check		1x _CHALLENGE_FAILED True IP LocalOnly all 2_days Updated
Chall_Pass Any 1x 12hour			Trust Tag Check		1x _CHALLENGE_PASSED All LocalOnly all 12_hours Updated
Chall_Pass Identity 1x 12hour			Trust Tag Check		1x _CHALLENGE_PASSED Digital ID LocalOnly all 12_hours Updated
Chall_Pass Device 1x 12hour		2.0	Trust Tag Check		1x _CHALLENGE_PASSED Smart ID LocalOnly all 12_hours Updated
Chall_Pass Email 1x 12hour			Trust Tag Check		1x _CHALLENGE_PASSED Account Email LocalOnly all 12_hours Updated
Chall_Pass User 1x 12hour			Trust Tag Check		1x _CHALLENGE_PASSED Account Login LocalOnly all 12_hours Updated
Chall_Pass IP 1x 12hour			Trust Tag Check		1x _CHALLENGE_PASSED True IP LocalOnly all 12_hours Updated
Fraud_Conf Any 1x 15month Global			Trust Tag Check		1x _FRAUD_CONF All GlobalExcludingLocal all 15_months Updated
Fraud_Conf Identity 1x 15month Global			Trust Tag Check		1x _FRAUD_CONF Digital ID GlobalExcludingLocal all 15_months Updated
Fraud_Conf Device 1x 15month Global			Trust Tag Check		1x _FRAUD_CONF Smart ID GlobalExcludingLocal all 15_months Updated
Fraud_Conf Email 1x 15month Global			Trust Tag Check		1x _FRAUD_CONF Account Email GlobalExcludingLocal all 15_months Updated
Fraud_Conf IP 1x 15month Global			Trust Tag Check		1x _FRAUD_CONF True IP GlobalExcludingLocal all 15_months Updated
Fraud_Conf Device 1x 3month Global			Trust Tag Check		1x _FRAUD_CONF Smart ID GlobalExcludingLocal all 90_days Updated
Fraud_Conf Device 3x 3month Global			Trust Tag Check		1x _FRAUD_CONF Smart ID GlobalExcludingLocal all 90_days Updated
Fraud_Conf Device 9x 3month Global			Trust Tag Check		1x _FRAUD_CONF Smart ID GlobalExcludingLocal all 90_days Updated
Identity Rep Good			Entity Reputation		# EntityType: Digital ID, Scale: yes, white_black: whitelist
Email Rep Good		10.0	Entity Reputation		# EntityType: Account Email, Scale: yes, white_black: whitelist
Phone Rep Good		10.0	Entity Reputation		# EntityType: Account Telephone, Scale: yes, white_black: whitelist
Device Rep Good		10.0	Entity Reputation		# EntityType: Smart ID, Scale: yes, white_black: whitelist
IP Rep Good			Entity Reputation		# EntityType: True IP, Scale: yes, white_black: whitelist
Proxy Rep Good			Entity Reputation		# EntityType: Proxy IP, Scale: yes, white_black: whitelist
Identity Rep Bad			Entity Reputation		# EntityType: Exact ID, Scale: yes, white_black: blacklist
Email Rep Bad		10.0	Entity Reputation		# EntityType: Exact ID, Scale: yes, white_black: whitelist
Phone Rep Bad		10.0	Entity Reputation		# EntityType: Account Telephone, Scale: yes, white_black: blacklist
Device Rep Bad		10.0	Entity Reputation		# EntityType: Smart ID, Scale: yes, white_black: blacklist
IP Rep Bad			Entity Reputation		# EntityType: True IP, Scale: yes, white_black: blacklist
Proxy Rep Bad			Entity Reputation		# EntityType: Proxy IP, Scale: yes, white_black: blacklist
Email Rejected 1day new			Review Status		Account Email Reject local account_creation day
Device Rejected 1day new			Review Status		Smart ID Reject local account_creation day
IP Rejected 1day new			Review Status		True IP Reject local account_creation day
Email Rejected 1day login			Review Status		Account Email Reject local login day
Device Rejected 1day login			Review Status		Smart ID Reject local login day
IP Rejected 1day login			Review Status		True IP Reject local login day
Email Rejected 1day pay			Review Status		Account Email Reject local payment day
Device Rejected 1day pay			Review Status		Smart ID Reject local payment day
IP Rejected 1day pay			Review Status		True IP Reject local payment day
Email Rejected 1month new			Review Status		Account Email Reject local account_creation month
Device Rejected 1month new		-3.0	Review Status		Smart ID Reject local account_creation month
IP Rejected 1month new			Review Status		True IP Reject local account_creation month
Email Rejected 1month login			Review Status		Account Email Reject local login month
Device Rejected 1month login		-2.0	Review Status		Smart ID Reject local login month
IP Rejected 1month login			Review Status		True IP Reject local login month
Email Rejected 1month pay			Review Status		Account Email Reject local payment month
Device Rejected 1month pay		-5.0	Review Status		Smart ID Reject local payment month
IP Rejected 1month pay			Review Status		True IP Reject local payment month
Email Rejected 1month new Global			Review Status		Account Email Reject global account_creation month
Device Rejected 1month new Global			Review Status		Smart ID Reject global account_creation month
IP Rejected 1month new Global			Review Status		True IP Reject global account_creation month
Email Rejected 1month login Global			Review Status		Account Email Reject global login month
Device Rejected 1month login Global			Review Status		Smart ID Reject global login month
IP Rejected 1month login Global			Review Status		True IP Reject global login month
Email Rejected 1month pay Global			Review Status		Account Email Reject global payment month
Device Rejected 1month pay Global			Review Status		Smart ID Reject global payment month
IP Rejected 1month pay Global			Review Status		True IP Reject global payment month
Blacklisted IP from ecom			Attribute in Shared List		# Attribute: True IP, Categories: BLACK, Converted: 1001390338, PrimaryIndustryFilter: 200, Scope: global
Blacklisted Proxy from ecom			Attribute in Shared List		# Attribute: Proxy IP, Categories: BLACK, Converted: 1001390339, PrimaryIndustryFilter: 200, Scope: global
Blacklisted Device from ecom			Attribute in Shared List		# Attribute: Smart ID, Categories: BLACK, Converted: 1001390340, PrimaryIndustryFilter: 200, Scope: global
Blacklisted Email from ecom			Attribute in Shared List		# Attribute: Account Email, Categories: BLACK, Converted: 1001390341, PrimaryIndustryFilter: 200, Scope: global
Blacklisted Identity from ecom			Attribute in Shared List		# Attribute: Digital ID, Categories: BLACK, Converted: 1001390342, PrimaryIndustryFilter: 200, Scope: global
Blacklisted Any from ecom		-3.0	IF		Blacklisted IP from ecom \| Blacklisted Proxy from ecom \| Blacklisted Device from ecom \| Blacklisted Email from ecom \| Blacklisted Identity from ecom
Blacklisted IP from bank			Attribute in Shared List		# Attribute: True IP, Categories: BLACK, Converted: 1001390345, PrimaryIndustryFilter: 100, Scope: global
Blacklisted Proxy from bank			Attribute in Shared List		# Attribute: Proxy IP, Categories: BLACK, Converted: 1001390346, PrimaryIndustryFilter: 100, Scope: global
Blacklisted Device from bank			Attribute in Shared List		# Attribute: Smart ID, Categories: BLACK, Converted: 1001390347, PrimaryIndustryFilter: 100, Scope: global
Blacklisted Email from bank			Attribute in Shared List		# Attribute: Account Email, Categories: BLACK, Converted: 1001390348, PrimaryIndustryFilter: 100, Scope: global
Blacklisted Identity from bank			Attribute in Shared List		# Attribute: Digital ID, Categories: BLACK, Converted: 1001390349, PrimaryIndustryFilter: 100, Scope: global
Blacklisted Any from bank		-5.0	IF		Blacklisted IP from bank \| Blacklisted Proxy from bank \| Blacklisted Device from bank \| Blacklisted Email from bank \| Blacklisted Identity from bank
Blacklisted IP			Attribute in Shared List		# Attribute: True IP, Categories: BLACK, Converted: 1001390352, Scope: global
Blacklisted Proxy			Attribute in Shared List		# Attribute: Proxy IP, Categories: BLACK, Converted: 1001390353, Scope: global
Blacklisted Device			Attribute in Shared List		# Attribute: Smart ID, Categories: BLACK, Converted: 1001390354, Scope: global
Blacklisted Email			Attribute in Shared List		# Attribute: Account Email, Categories: BLACK, Converted: 1001390355, Scope: global
Blacklisted Identity			Attribute in Shared List		# Attribute: Digital ID, Categories: BLACK, Converted: 1001390356, Scope: global
Blacklisted Any		-5.0	IF		Blacklisted IP \| Blacklisted Proxy \| Blacklisted Device \| Blacklisted Email \| Blacklisted Identity
Identity Age 1year			Age	Yes	first_seen Digital ID less than year
Identity Age -1year			Age		first_seen Digital ID less than year
Identity Age -6month			Age		first_seen Digital ID less than 6 months
Identity Age -3month			Age		first_seen Digital ID less than 3 months
Identity Age -1month			Age		first_seen Digital ID less than month
Identity Age -1week			Age		first_seen Digital ID less than week
Identity Age -1day			Age		first_seen Digital ID less than day
Identify Age New		-5.0	Condition		Digital ID is present & Digital ID First Seen is absent
User Age 1year			Age	Yes	first_seen Account Login less than year
User Age -1year			Age		first_seen Account Login less than year
User Age -6month			Age		first_seen Account Login less than 6 months
User Age -3month			Age		first_seen Account Login less than 3 months
User Age -1month			Age		first_seen Account Login less than month
User Age -1week			Age		first_seen Account Login less than week
User Age -1day			Age		first_seen Account Login less than day
User Age New			Condition		Account Login is present & Account Login First Seen is absent
Email Age 1year			Age	Yes	first_seen Account Email less than year
Email Age -1year			Age		first_seen Account Email less than year
Email Age -6month			Age		first_seen Account Email less than 6 months
Email Age -3month			Age		first_seen Account Email less than 3 months
Email Age -1month			Age		first_seen Account Email less than month
Email Age -1week			Age		first_seen Account Email less than week
Email Age -1day			Age		first_seen Account Email less than day
Email Age New		-3.0	Condition		Account Email is present & Account Email First Seen is absent
Device Age 1year			Age	Yes	first_seen Smart ID less than year
Device Age -1year			Age		first_seen Smart ID less than year
Device Age -6month			Age		first_seen Smart ID less than 6 months
Device Age -3month			Age		first_seen Smart ID less than 3 months
Device Age -1month			Age		first_seen Smart ID less than month
Device Age -1week			Age		first_seen Smart ID less than week
Device Age -1day			Age		first_seen Smart ID less than day
Device Age New		-3.0	Condition		Smart ID is present & Smart ID First Seen is absent
IP Age 1year			Age	Yes	first_seen True IP less than year
IP Age -1year			Age		first_seen True IP less than year
IP Age -6month			Age		first_seen True IP less than 6 months
IP Age -3month			Age		first_seen True IP less than 3 months
IP Age -1month			Age		first_seen True IP less than month
IP Age -1week			Age		first_seen True IP less than week
IP Age -1day			Age		first_seen True IP less than day
IP Age New		-3.0	Condition		True IP is present & True IP First Seen is absent
Phone Age 1year			Age	Yes	first_seen Account Telephone less than year
Phone Age -1year			Age		first_seen Account Telephone less than year
Phone Age -6month			Age		first_seen Account Telephone less than 6 months
Phone Age -3month			Age		first_seen Account Telephone less than 3 months
Phone Age -1month			Age		first_seen Account Telephone less than month
Phone Age -1week			Age		first_seen Account Telephone less than week
Phone Age -1day			Age		first_seen Account Telephone less than day
Phone Age New			Condition		Account Telephone is present & Account Telephone First Seen is absent
Identity Vel 0x 1month Global			Entity Velocity	Yes	2x Digital ID global very_long
Identity Vel 2x 1hour			Entity Velocity		2x Digital ID local short
Identity Vel 4x 1hour		-1.0	Entity Velocity		4x Digital ID local short
Identity Vel 8x 1hour		-4.0	Entity Velocity		8x Digital ID local short
Identity Vel 16x 1hour		-5.0	Entity Velocity		16x Digital ID local short
Identity Vel 2x 1day new			Event Type Velocity		# EntityType: Digital ID, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 2
Identity Vel 4x 1day new			Event Type Velocity		# EntityType: Digital ID, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
Identity Vel 8x 1day new			Event Type Velocity		# EntityType: Digital ID, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
Identity Vel 16x 1day new			Event Type Velocity		# EntityType: Digital ID, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 16
Identity Vel 2x 1day login			Event Type Velocity		# EntityType: Digital ID, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 2
Identity Vel 4x 1day login			Event Type Velocity		# EntityType: Digital ID, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
Identity Vel 8x 1day login			Event Type Velocity		# EntityType: Digital ID, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
Identity Vel 16x 1day login			Event Type Velocity		# EntityType: Digital ID, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 16
Identity Vel 2x 1day pay			Event Type Velocity		# EntityType: Digital ID, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 2
Identity Vel 4x 1day pay			Event Type Velocity		# EntityType: Digital ID, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
Identity Vel 8x 1day pay			Event Type Velocity		# EntityType: Digital ID, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
Identity Vel 16x 1day pay			Event Type Velocity		# EntityType: Digital ID, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 16
Identity Vel 4x 1week new			Event Type Velocity		# EntityType: Digital ID, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: week, threshold: 4
Identity Vel 4x 1week login			Event Type Velocity		# EntityType: Digital ID, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: week, threshold: 4
Identity Vel 4x 1week pay			Event Type Velocity		# EntityType: Digital ID, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: week, threshold: 4
User Vel 0x 1month			Entity Velocity	Yes	2x Account Login local very_long
User Vel 2x 1hour			Entity Velocity		2x Account Login local short
User Vel 4x 1hour			Entity Velocity		4x Account Login local short
User Vel 8x 1hour			Entity Velocity		8x Account Login local short
User Vel 16x 1hour			Entity Velocity		16x Account Login local short
User Vel 2x 1day new			Event Type Velocity		# EntityType: Account Login, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 2
User Vel 4x 1day new			Event Type Velocity		# EntityType: Account Login, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
User Vel 8x 1day new			Event Type Velocity		# EntityType: Account Login, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
User Vel 16x 1day new			Event Type Velocity		# EntityType: Account Login, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 16
User Vel 2x 1day login			Event Type Velocity		# EntityType: Account Login, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 2
User Vel 4x 1day login			Event Type Velocity		# EntityType: Account Login, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
User Vel 8x 1day login			Event Type Velocity		# EntityType: Account Login, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
User Vel 16x 1day login			Event Type Velocity		# EntityType: Account Login, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
User Vel 4x 1day pay			Event Type Velocity		# EntityType: Account Login, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
User Vel 8x 1day pay			Event Type Velocity		# EntityType: Account Login, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
User Vel 16x 1day pay			Event Type Velocity		# EntityType: Account Login, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 16
User-Bene 0x 1month			Attribute Velocity	Yes	2x Account Number - Account Login local all month
User-Bene 2x 1hour			Attribute Velocity		2x Account Number - Account Login local all hour
User-Bene 4x 1hour			Attribute Velocity		4x Account Number - Account Login local all hour
User-Bene 8x 1hour			Attribute Velocity		8x Account Number - Account Login local all hour
User-Bene 16x 1hour			Attribute Velocity		16x Account Number - Account Login local all hour
User-Bene 2x 1day			Attribute Velocity		2x Account Number - Account Login local all day
User-Bene 4x 1day			Attribute Velocity		4x Account Number - Account Login local all day
User-Bene 8x 1day			Attribute Velocity		8x Account Number - Account Login local all day
User-Bene 16x 1day			Attribute Velocity		16x Account Number - Account Login local all day
User-Bene 2x 1week			Attribute Velocity		2x Account Number - Account Login local all week
User-Bene 4x 1week			Attribute Velocity		4x Account Number - Account Login local all week
User-Bene 8x 1week			Attribute Velocity		8x Account Number - Account Login local all week
User-Bene 16x 1week			Attribute Velocity		16x Account Number - Account Login local all week
User-Bene 2x 1month			Attribute Velocity		2x Account Number - Account Login local all month
User-Bene 4x 1month			Attribute Velocity		4x Account Number - Account Login local all month
User-Bene 8x 1month			Attribute Velocity		8x Account Number - Account Login local all month
User-Bene 16x 1month			Attribute Velocity		16x Account Number - Account Login local all month
Device Vel 0x 1month			Entity Velocity	Yes	2x Smart ID global very_long
Device Vel 2x 1hour			Entity Velocity		2x Smart ID local short
Device Vel 4x 1hour			Entity Velocity		4x Smart ID local short
Device Vel 8x 1hour			Entity Velocity		8x Smart ID local short
Device Vel 16x 1hour			Entity Velocity		16x Smart ID local short
Device Vel 2x 1day new			Event Type Velocity		# EntityType: Smart ID, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 2
Device Vel 4x 1day new			Event Type Velocity		# EntityType: Smart ID, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
Device Vel 8x 1day new			Event Type Velocity		# EntityType: Smart ID, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
Device Vel 16x 1day new			Event Type Velocity		# EntityType: Smart ID, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 16
Device Vel 2x 1day login			Event Type Velocity		# EntityType: Smart ID, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 2
Device Vel 4x 1day login			Event Type Velocity		# EntityType: Smart ID, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
Device Vel 16x 1day login			Event Type Velocity		# EntityType: Smart ID, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 16
Device Vel 2x 1day pay			Event Type Velocity		# EntityType: Smart ID, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 2
Device Vel 4x 1day pay			Event Type Velocity		# EntityType: Smart ID, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
Device Vel 8x 1day pay			Event Type Velocity		# EntityType: Smart ID, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
Device Vel 16x 1day pay			Event Type Velocity		# EntityType: Smart ID, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 16
Device Vel 4x 1week new			Event Type Velocity		# EntityType: Smart ID, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: week, threshold: 4
Device Vel 4x 1week login			Event Type Velocity		# EntityType: Smart ID, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: week, threshold: 4
Device Vel 4x 1week pay			Event Type Velocity		# EntityType: Smart ID, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: week, threshold: 4
Device Vel 16x 1hour Global			Entity Velocity		16x Smart ID global short
Device Vel 32x 1hour Global			Entity Velocity		32x Smart ID global short
Device Vel 16x 1day Global			Entity Velocity		16x Smart ID global medium
Device Vel 32x 1day Global			Entity Velocity		32x Smart ID global medium
IP Vel 0x 1month Global			Entity Velocity	Yes	2x True IP global very_long
IP Vel 2x 1hour			Entity Velocity		2x True IP local short
IP Vel 4x 1hour			Entity Velocity		4x True IP local short
IP Vel 8x 1hour			Entity Velocity		8x True IP local short
IP Vel 16x 1hour			Entity Velocity		16x True IP local short
IP Vel 2x 1day new			Event Type Velocity		# EntityType: True IP, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 2
IP Vel 4x 1day new			Event Type Velocity		# EntityType: True IP, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
IP Vel 8x 1day new			Event Type Velocity		# EntityType: True IP, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
IP Vel 16x 1day new			Event Type Velocity		# EntityType: True IP, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 16
IP Vel 2x 1day login			Event Type Velocity		# EntityType: True IP, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 2
IP Vel 4x 1day login			Event Type Velocity		# EntityType: True IP, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
IP Vel 8x 1day login			Event Type Velocity		# EntityType: True IP, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
IP Vel 16x 1day login			Event Type Velocity		# EntityType: True IP, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 16
IP Vel 2x 1day pay			Event Type Velocity		# EntityType: True IP, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 2
IP Vel 4x 1day pay			Event Type Velocity		# EntityType: True IP, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 4
IP Vel 8x 1day pay			Event Type Velocity		# EntityType: True IP, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 8
IP Vel 16x 1day pay			Event Type Velocity		# EntityType: True IP, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: day, threshold: 16
IP Vel 4x 1week new			Event Type Velocity		# EntityType: True IP, EventType: account_creation, HistoryDepth: 100, Scope: local, TimeFrame: week, threshold: 4
IP Vel 4x 1week login			Event Type Velocity		# EntityType: True IP, EventType: login, HistoryDepth: 100, Scope: local, TimeFrame: week, threshold: 4
IP Vel 4x 1week pay			Event Type Velocity		# EntityType: True IP, EventType: payment, HistoryDepth: 100, Scope: local, TimeFrame: week, threshold: 4
IP Vel 16x 1hour Global			Entity Velocity		16x True IP global short
IP Vel 32x 1hour Global			Entity Velocity		32x True IP global short
IP Vel 16x 1day Global			Entity Velocity		16x True IP global medium
IP Vel 32x 1day Global			Entity Velocity		32x True IP global medium
Bene Vel 0x 1month			Entity Velocity	Yes	2x Account Number local very_long
Bene Vel 2x 1hour			Entity Velocity		2x Account Number local short
Bene Vel 4x 1hour			Entity Velocity		4x Account Number local short
Ben Vel 8x 1hour			Entity Velocity		8x Account Number local short
Ben Vel 16x 1hour			Entity Velocity		16x Account Number local short
Bene Vel 2x 1day			Entity Velocity		2x Account Number local medium
Bene Vel 4x 1day			Entity Velocity		4x Account Number local medium
Bene Vel 8x 1day			Entity Velocity		8x Account Number local medium
Bene Vel 16x 1day			Entity Velocity		16x Account Number local medium
Bene Vel 2x 1week			Entity Velocity		2x Account Number local long
Bene Vel 4x 1week			Entity Velocity		4x Account Number local short
Bene Vel 8x 1week			Entity Velocity		8x Account Number local short
Bene Vel 16x 1week			Entity Velocity		16x Account Number local short
Bene Vel 2x 1month			Entity Velocity		2x Account Number local very_long
Bene Vel 4x 1month			Entity Velocity		4x Account Number local very_long
Bene Vel 8x 1month			Entity Velocity		8x Account Number local very_long
Bene Vel 16x 1month			Entity Velocity		16x Account Number local very_long
Tel Vel 0x 1month			Entity Velocity	Yes	2x Account Telephone local very_long
Tel Vel 2x 1hour			Entity Velocity		2x Account Telephone local short
Tel Vel 4x 1hour			Entity Velocity		4x Account Telephone local short
Tel Vel 8x 1hour			Entity Velocity		8x Account Telephone local short
Tel Vel 16x 1hour			Entity Velocity		16x Account Telephone local short
Tel Vel 2x 1day			Entity Velocity		2x Account Telephone local medium
Tel Vel 4x 1day			Entity Velocity		4x Account Telephone local medium
Tel Vel 8x 1day			Entity Velocity		8x Account Telephone local medium
Tel Vel 16x 1day			Entity Velocity		16x Account Telephone local medium
Tel Vel 2x 1week			Entity Velocity		2x Account Telephone local long
Tel Vel 4x 1week			Entity Velocity		4x Account Telephone local short
Tel Vel 8x 1week			Entity Velocity		8x Account Telephone local short
Tel Vel 16x 1week			Entity Velocity		16x Account Telephone local short
Tel Vel 2x 1month			Entity Velocity		2x Account Telephone local very_long
Tel Vel 4x 1month			Entity Velocity		4x Account Telephone local very_long
Tel Vel 8x 1month			Entity Velocity		8x Account Telephone local very_long
Tel Vel 16x 1month			Entity Velocity		16x Account Telephone local very_long
Email-Device 0x 1year Global			Attribute Velocity	Yes	2x Account Email - Smart ID global all year
Email-Device 2x 1year Global		1.0	Attribute Velocity		2x Account Email - Smart ID global all year
Email-Device 4x 1year Global		2.0	Attribute Velocity		4x Account Email - Smart ID global all year
Email-Device 8x 1year Global			Attribute Velocity		8x Account Email - Smart ID global all year
Email-Device 16x 1year Global			Attribute Velocity		16x Account Email - Smart ID global all year
Phone-Device 0x 1year Global			Attribute Velocity	Yes	2x Account Telephone - Smart ID global all year
Phone-Device 2x 1year Global			Attribute Velocity		2x Account Telephone - Smart ID global all year
Phone-Device 4x 1year Global		2.0	Attribute Velocity		4x Account Telephone - Smart ID global all year
Phone-Device 8x 1year Global			Attribute Velocity		8x Account Telephone - Smart ID global all year
Phone-Device 16x 1year Global			Attribute Velocity		16x Account Telephone - Smart ID global all year
User-Email-Device-IP Match 0x 1week		5.0	Multiple Attribute Velocity	Yes	2x Account Login - Account Email - Smart ID - True IPLast_7_days)
User-Email-Device-IP Match 2x 1week			Multiple Attribute Velocity		2x Account Login - Account Email - Smart ID - True IPLast_7_days)
User-Email-Device-IP Match 4x 1week			Multiple Attribute Velocity		4x Account Login - Account Email - Smart ID - True IPLast_7_days)
User-Email-Device-IP Match 8x 1week			Multiple Attribute Velocity		8x Account Login - Account Email - Smart ID - True IPLast_7_days)
User-Email-Device-IP Match 16x 1week			Multiple Attribute Velocity		16x Account Login - Account Email - Smart ID - True IPLast_7_days)
User-IP Match 0x 1week			Multiple Attribute Velocity	Yes	2x Account Login - True IPLast_7_days)
User-IP Match 2x 1week			Multiple Attribute Velocity		2x Account Login - True IPLast_7_days)
User-IP Match 4x 1week			Multiple Attribute Velocity		4x Account Login - True IPLast_7_days)
User-IP Match 8x 1week			Multiple Attribute Velocity		8x Account Login - True IPLast_7_days)
User-IP Match 16x 1week			Multiple Attribute Velocity		16x Account Login - True IPLast_7_days)
User-Device Match 0x 1week			Multiple Attribute Velocity	Yes	2x Account Login - Smart IDLast_7_days)
User-Device Match 2x 1week			Multiple Attribute Velocity		2x Account Login - Smart IDLast_7_days)
User-Device Match 4x 1week			Multiple Attribute Velocity		4x Account Login - Smart IDLast_7_days)
User-Device Match 8x 1week			Multiple Attribute Velocity		8x Account Login - Smart IDLast_7_days)
User-Device Match 16x 1week			Multiple Attribute Velocity		16x Account Login - Smart IDLast_7_days)
User-Device Accepted 0x 1week-1month			Persona ID Related Events	Yes	# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_login, RelatedPassEnable: yes, RelatedThreshold: 2, Scope: local, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 2, SecondaryId2Name: browser, SecondaryId2Threshold: 2, TimeFrame: month, TimeFrameStart: Week
User-Device Accepted 2x 1week-1month			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_login, RelatedPassEnable: yes, RelatedThreshold: 2, Scope: local, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 2, SecondaryId2Name: browser, SecondaryId2Threshold: 2, TimeFrame: month, TimeFrameStart: Week
User-Device Accepted 4x 1week-1month			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_login, RelatedPassEnable: yes, RelatedThreshold: 4, Scope: local, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 4, SecondaryId2Name: browser, SecondaryId2Threshold: 4, TimeFrame: month, TimeFrameStart: Week
User-Device Accepted 8x 1week-1month			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_login, RelatedPassEnable: yes, RelatedThreshold: 8, Scope: local, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 8, SecondaryId2Name: browser, SecondaryId2Threshold: 8, TimeFrame: month, TimeFrameStart: Week
User-Device Accepted 16x 1week-1month			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_login, RelatedPassEnable: yes, RelatedThreshold: 16, Scope: local, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 16, SecondaryId2Name: browser, SecondaryId2Threshold: 16, TimeFrame: month, TimeFrameStart: Week
User-Device Accepted 0x 1month-3month			Persona ID Related Events	Yes	# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_login, RelatedPassEnable: yes, RelatedThreshold: 2, Scope: local, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 2, SecondaryId2Name: browser, SecondaryId2Threshold: 2, TimeFrame: 3Months, TimeFrameStart: Month
User-Device Accepted 2x 1month-3month			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_login, RelatedPassEnable: yes, RelatedThreshold: 2, Scope: local, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 2, SecondaryId2Name: browser, SecondaryId2Threshold: 2, TimeFrame: 3Months, TimeFrameStart: Month
User-Device Accepted 4x 1month-3month			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_login, RelatedPassEnable: yes, RelatedThreshold: 4, Scope: local, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 4, SecondaryId2Name: browser, SecondaryId2Threshold: 4, TimeFrame: 3Months, TimeFrameStart: Month
User-Device Accepted 8x 1month-3month			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_login, RelatedPassEnable: yes, RelatedThreshold: 8, Scope: local, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 8, SecondaryId2Name: browser, SecondaryId2Threshold: 8, TimeFrame: 3Months, TimeFrameStart: Month
User-Device Accepted 16x 1month-3month			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_login, RelatedPassEnable: yes, RelatedThreshold: 16, Scope: local, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 16, SecondaryId2Name: browser, SecondaryId2Threshold: 16, TimeFrame: 3Months, TimeFrameStart: Month
Email-Device Accepted 0x 1month-3month Global			Persona ID Related Events	Yes	# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_email, RelatedPassEnable: yes, RelatedThreshold: 2, Scope: global, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 2, TimeFrame: 3Months, TimeFrameStart: Month
Email-Device Accepted 2x 1month-3month Global			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_email, RelatedPassEnable: yes, RelatedThreshold: 2, Scope: global, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 2, TimeFrame: 3Months, TimeFrameStart: Month
Email-Device Accepted 4x 1month-3month Global			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_email, RelatedPassEnable: yes, RelatedThreshold: 4, Scope: global, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 4, TimeFrame: 3Months, TimeFrameStart: Month
Email-Device Accepted 8x 1month-3month Global			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_email, RelatedPassEnable: yes, RelatedThreshold: 8, Scope: global, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 8, TimeFrame: 3Months, TimeFrameStart: Month
Email-Device Accepted 16x 1month-3month Global			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: account_email, RelatedPassEnable: yes, RelatedThreshold: 16, Scope: global, SecondaryId1Name: fuzzy_device_id, SecondaryId1Threshold: 16, TimeFrame: 3Months, TimeFrameStart: Month
Device-IP Accepted 0x 1month-3month Global			Persona ID Related Events	Yes	# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: fuzzy_device_id, RelatedPassEnable: yes, RelatedThreshold: 2, Scope: global, SecondaryId1Name: true_ip, SecondaryId1Threshold: 2, TimeFrame: 3Months, TimeFrameStart: Month
Device-IP Accepted 2x 1month-3month Global			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: fuzzy_device_id, RelatedPassEnable: yes, RelatedThreshold: 2, Scope: global, SecondaryId1Name: true_ip, SecondaryId1Threshold: 2, TimeFrame: 3Months, TimeFrameStart: Month
Device-IP Accepted 4x 1month-3month Global			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: fuzzy_device_id, RelatedPassEnable: yes, RelatedThreshold: 4, Scope: global, SecondaryId1Name: true_ip, SecondaryId1Threshold: 4, TimeFrame: 3Months, TimeFrameStart: Month
Device-IP Accepted 8x 1month-3month Global			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: fuzzy_device_id, RelatedPassEnable: yes, RelatedThreshold: 8, Scope: global, SecondaryId1Name: true_ip, SecondaryId1Threshold: 8, TimeFrame: 3Months, TimeFrameStart: Month
Device-IP Accepted 16x 1month-3month Global			Persona ID Related Events		# AgeEnable: No, AgeType: All, BehaviorType: Convergence, EventType: all, MatchType: positive, PivotId1: fuzzy_device_id, RelatedPassEnable: yes, RelatedThreshold: 16, Scope: global, SecondaryId1Name: true_ip, SecondaryId1Threshold: 16, TimeFrame: 3Months, TimeFrameStart: Month
Identity Email Change 2x 1hour Global			Attribute Anomaly		2x Account Email / Digital ID global hour
Identity Email Change 4x 1hour Global			Attribute Anomaly		4x Account Email / Digital ID global hour
Identity Email Change 8x 1hour Global			Attribute Anomaly		8x Account Email / Digital ID global hour
Identity Email Change 16x 1hour Global			Attribute Anomaly		16x Account Email / Digital ID global hour
Identity Email Change 2x 1week Global			Attribute Anomaly		2x Account Email / Digital ID global week
Identity Email Change 4x 1week Global			Attribute Anomaly		4x Account Email / Digital ID global week
Identity Email Change 8x 1week Global			Attribute Anomaly		8x Account Email / Digital ID global week
Identity Email Change 16x 1week Global			Attribute Anomaly		16x Account Email / Digital ID global week
Identity Email Change 2x 1month Global			Attribute Anomaly		2x Account Email / Digital ID global month
Identity Email Change 4x 1month Global			Attribute Anomaly		4x Account Email / Digital ID global month
Identity Email Change 8x 1month Global			Attribute Anomaly		8x Account Email / Digital ID global month
Identity Email Change 16x 1month Global			Attribute Anomaly		16x Account Email / Digital ID global month
Identity Email Change 2x 1year Global			Attribute Anomaly		2x Account Email / Digital ID global year
Identity Email Change 4x 1year Global			Attribute Anomaly		4x Account Email / Digital ID global year
Identity Email Change 8x 1year Global		-10.0	Attribute Anomaly		8x Account Email / Digital ID global year
Identity Email Change 16x 1year Global		-20.0	Attribute Anomaly		16x Account Email / Digital ID global year
Identity Email Change 0x 1year Global		2.0	Attribute Anomaly	Yes	2x Account Email / Digital ID global year
Identity Device Change 2x 1hour Global			Attribute Anomaly		2x Smart ID / Digital ID global hour
Identity Device Change 4x 1hour Global			Attribute Anomaly		4x Smart ID / Digital ID global hour
Identity Device Change 8x 1hour Global			Attribute Anomaly		8x Smart ID / Digital ID global hour
Identity Device Change 16x 1hour Global			Attribute Anomaly		16x Smart ID / Digital ID global hour
Identity Device Change 2x 1week Global			Attribute Anomaly		2x Smart ID / Digital ID global week
Identity Device Change 4x 1week Global			Attribute Anomaly		4x Smart ID / Digital ID global week
Identity Device Change 8x 1week Global			Attribute Anomaly		8x Smart ID / Digital ID global week
Identity Device Change 16x 1week Global			Attribute Anomaly		16x Smart ID / Digital ID global week
Identity Device Change 2x 1month Global			Attribute Anomaly		2x Smart ID / Digital ID global month
Identity Device Change 4x 1month Global			Attribute Anomaly		4x Smart ID / Digital ID global month
Identity Device Change 8x 1month Global			Attribute Anomaly		8x Smart ID / Digital ID global month
Identity Device Change 16x 1month Global			Attribute Anomaly		16x Smart ID / Digital ID global month
Identity Device Change 2x 1year Global			Attribute Anomaly		2x Smart ID / Digital ID global year
Identity Device Change 4x 1year Global			Attribute Anomaly		4x Smart ID / Digital ID global year
Identity Device Change 8x 1year Global		-10.0	Attribute Anomaly		3x Smart ID / Digital ID global year
Identity Device Change 16x 1year Global		-20.0	Attribute Anomaly		16x Smart ID / Digital ID global year
Identity Device Change 0x 1year Global		2.0	Attribute Anomaly	Yes	2x Smart ID / Digital ID global year
Email Device Change 2x 1hour Global			Attribute Anomaly		2x Smart ID / Account Email global hour
Email Device Change 4x 1hour Global			Attribute Anomaly		4x Smart ID / Account Email global hour
Email Device Change 8x 1hour Global			Attribute Anomaly		8x Smart ID / Account Email global hour
Email Device Change 16x 1hour Global			Attribute Anomaly		16x Smart ID / Account Email global hour
Email Device Change 2x 1week Global			Attribute Anomaly		3x Smart ID / Account Email global week
Email Device Change 4x 1week Global			Attribute Anomaly		4x Smart ID / Account Email global week
Email Device Change 8x 1week Global			Attribute Anomaly		8x Smart ID / Account Email global week
Email Device Change 16x 1week Global			Attribute Anomaly		16x Smart ID / Account Email global week
Email Device Change 2x 1month Global			Attribute Anomaly		2x Smart ID / Account Email global month
Email Device Change 4x 1month Global			Attribute Anomaly		4x Smart ID / Account Email global month
Email Device Change 8x 1month Global			Attribute Anomaly		8x Smart ID / Account Email global month
EmailDevice Change 16x 1month Global			Attribute Anomaly		16x Smart ID / Account Email global month
Email Device Change 2x 1year Global			Attribute Anomaly		2x Smart ID / Account Email global year
Email Device Change 4x 1year Global			Attribute Anomaly		4x Smart ID / Account Email global year
Email Device Change 8x 1year Global		-10.0	Attribute Anomaly		8x Smart ID / Account Email global year
Email Device Change 16x 1year Global		-20.0	Attribute Anomaly		16x Smart ID / Account Email global year
Email Device Change 0x 1year Global		2.0	Attribute Anomaly	Yes	2x Smart ID / Account Email global year
Email Phone Change 2x 1hour Global			Attribute Anomaly		2x Account Telephone / Account Email global hour
Email Phone Change 4x 1hour Global			Attribute Anomaly		4x Account Telephone / Account Email global hour
Email Phone Change 8x 1hour Global			Attribute Anomaly		8x Account Telephone / Account Email global hour
Email Phone Change 16x 1hour Global			Attribute Anomaly		16x Account Telephone / Account Email global hour
Email Phone Change 2x 1week Global			Attribute Anomaly		2x Account Telephone / Account Email global week
Email Phone Change 4x 1week Global			Attribute Anomaly		4x Account Telephone / Account Email global week
Email Phone Change 8x 1week Global			Attribute Anomaly		8x Account Telephone / Account Email global week
Email Phone Change 16x 1week Global			Attribute Anomaly		16x Account Telephone / Account Email global week
Email Phone Change 2x 1month Global			Attribute Anomaly		2x Account Telephone / Account Email global month
Email Phone Change 4x 1month Global			Attribute Anomaly		4x Account Telephone / Account Email global month
Email Phone Change 8x 1month Global			Attribute Anomaly		8x Account Telephone / Account Email global month
Email Phone Change 16x 1month Global			Attribute Anomaly		16x Account Telephone / Account Email global month
Email Phone Change 2x 1year Global			Attribute Anomaly		2x Account Telephone / Account Email global year
Email Phone Change 4x 1year Global		-2.0	Attribute Anomaly		4x Account Telephone / Account Email global year
Email Phone Change 8x 1year Global		-1.0	Attribute Anomaly		8x Account Telephone / Account Email global year
Email Phone Change 16x 1year Global		-2.0	Attribute Anomaly		16x Account Telephone / Account Email global year
Email Phone Change 0x 1year Global			Attribute Anomaly	Yes	2x Account Telephone / Account Email global year
User Device Change 2x 1hour			Attribute Anomaly		2x Smart ID / Account Login local hour
User Device Change 4x 1hour			Attribute Anomaly		4x Smart ID / Account Login local hour
User Device Change 8x 1hour			Attribute Anomaly		8x Smart ID / Account Login local hour
User Device Change 16x 1hour			Attribute Anomaly		16x Smart ID / Account Login local hour
User Device Change 2x 1week			Attribute Anomaly		2x Smart ID / Account Login local week
User Device Change 4x 1week			Attribute Anomaly		4x Smart ID / Account Login local week
User Device Change 8x 1week			Attribute Anomaly		8x Smart ID / Account Login local week
User Device Change 16x 1week			Attribute Anomaly		16x Smart ID / Account Login local week
User Device Change 2x 1month			Attribute Anomaly		2x Smart ID / Account Login local month
User Device Change 4x 1month			Attribute Anomaly		4x Smart ID / Account Login local month
User Device Change 8x 1month			Attribute Anomaly		8x Smart ID / Account Login local month
User Device Change 16x 1month			Attribute Anomaly		16x Smart ID / Account Login local month
User Device Change 2x 1year			Attribute Anomaly		2x Smart ID / Account Login local year
User Device Change 4x 1year		-5.0	Attribute Anomaly		4x Smart ID / Account Login local year
User Device Change 8x 1year		-10.0	Attribute Anomaly		8x Smart ID / Account Login local year
User Device Change 16x 1year			Attribute Anomaly		16x Smart ID / Account Login local year
User Device Change 0x 1year		2.0	Attribute Anomaly	Yes	2x Smart ID / Account Login local year
User Dest Change 2x 1hour			Attribute Anomaly		2x Account Number / Account Login local hour
User Dest Change 4x 1hour			Attribute Anomaly		4x Account Number / Account Login local hour
User Dest Change 8x 1hour			Attribute Anomaly		8x Account Number / Account Login local hour
User Dest Change 16x 1hour			Attribute Anomaly		16x Account Number / Account Login local hour
User Dest Change 2x 1week			Attribute Anomaly		2x Account Number / Account Login local week
User Dest Change 4x 1week			Attribute Anomaly		4x Account Number / Account Login local week
User Dest Change 8x 1week			Attribute Anomaly		8x Account Number / Account Login local week
User Dest Change 16x 1week			Attribute Anomaly		16x Account Number / Account Login local week
User Dest Change 2x 1month			Attribute Anomaly		2x Account Number / Account Login local month
User Dest Change 4x 1month			Attribute Anomaly		4x Account Number / Account Login local month
User Dest Change 8x 1month			Attribute Anomaly		8x Account Number / Account Login local month
User Dest Change 16x 1month			Attribute Anomaly		16x Account Number / Account Login local month
User Dest Change 2x 1year			Attribute Anomaly		2x Account Number / Account Login local year
User Dest Change 4x 1year			Attribute Anomaly		4x Account Number / Account Login local year
User Dest Change 8x 1year			Attribute Anomaly		8x Account Number / Account Login local year
User Dest Change 16x 1year			Attribute Anomaly		16x Account Number / Account Login local year
User Dest Change 0x 1year			Attribute Anomaly	Yes	2x Account Number / Account Login local year
Bene Send Change 2x 1hour			Attribute Anomaly		2x Custom Attribute 6 / Account Number local hour
Bene Send Change 4x 1hour			Attribute Anomaly		4x Custom Attribute 6 / Account Number local hour
Bene Send Change 8x 1hour			Attribute Anomaly		8x Custom Attribute 6 / Account Number local hour
Bene Send Change 16x 1hour			Attribute Anomaly		16x Custom Attribute 6 / Account Number local hour
Bene Send Change 2x 1week			Attribute Anomaly		2x Custom Attribute 6 / Account Number local week
Bene Send Change 4x 1week			Attribute Anomaly		4x Custom Attribute 6 / Account Number local week
Bene Send Change 8x 1week			Attribute Anomaly		8x Custom Attribute 6 / Account Number local week
Bene Send Change 16x 1week			Attribute Anomaly		16x Custom Attribute 6 / Account Number local week
Bene Send Change 2x 1month			Attribute Anomaly		2x Custom Attribute 6 / Account Number local month
Bene Send Change 4x 1month			Attribute Anomaly		4x Custom Attribute 6 / Account Number local month
Bene Send Change 8x 1month			Attribute Anomaly		8x Custom Attribute 6 / Account Number local month
Bene Send Change 16x 1month			Attribute Anomaly		16x Custom Attribute 6 / Account Number local month
Bene Send Change 2x 1year			Attribute Anomaly		2x Custom Attribute 6 / Account Number local year
Bene Send Change 4x 1year			Attribute Anomaly		4x Custom Attribute 6 / Account Number local year
Bene Send Change 8x 1year			Attribute Anomaly		8x Custom Attribute 6 / Account Number local year
Bene Send Change 16x 1year			Attribute Anomaly		16x Custom Attribute 6 / Account Number local year
Bene Send Change 0x 1year			Attribute Anomaly	Yes	2x Custom Attribute 6 / Account Number local year
User Country Change 2x 1hour			Attribute Anomaly		2x True IP Geo / Account Login local hour
User Country Change 4x 1hour			Attribute Anomaly		4x True IP Geo / Account Login local hour
User Country Change 8x 1hour			Attribute Anomaly		3x True IP Geo / Account Login local hour
User Country Change 16x 1hour			Attribute Anomaly		16x True IP / Account Login local hour
User Country Change 2x 1week			Attribute Anomaly		2x True IP Geo / Account Login local week
User Country Change 4x 1week			Attribute Anomaly		4x True IP Geo / Account Login local week
User Country Change 8x 1week			Attribute Anomaly		8x True IP Geo / Account Login local week
User Country Change 16x 1week			Attribute Anomaly		16x True IP Geo / Account Login local week
User Country Change 2x 1month			Attribute Anomaly		2x True IP Geo / Account Login local month
User Country Change 4x 1month			Attribute Anomaly		4x True IP Geo / Account Login local month
User Country Change 8x 1month			Attribute Anomaly		8x True IP Geo / Account Login local month
User Country Change 16x 1month			Attribute Anomaly		16x True IP Geo / Account Login local month
User Country Change 2x 1year			Attribute Anomaly		2x True IP Geo / Account Login local year
User Country Change 4x 1year			Attribute Anomaly		4x True IP Geo / Account Login local year
User Country Change 8x 1year			Attribute Anomaly		8x True IP Geo / Account Login local year
User Country Change 16x 1year			Attribute Anomaly		16x True IP Geo / Account Login local year
User Country Change 0x 1year			Attribute Anomaly	Yes	2x True IP Geo / Account Login local year
Device User Change 2x 1hour Global			Attribute Anomaly		2x Account Login / Smart ID global hour
Device User Change 4x 1hour Global			Attribute Anomaly		4x Account Login / Smart ID global hour
Device User Change 8x 1hour Global			Attribute Anomaly		8x Account Login / Smart ID global hour
Device User Change 16x 1hour Global			Attribute Anomaly		16x Account Login / Smart ID global hour
Device User Change 2x 1week Global			Attribute Anomaly		2x Account Login / Smart ID global week
Device User Change 4x 1week Global			Attribute Anomaly		4x Account Login / Smart ID global week
Device User Change 8x 1week Global			Attribute Anomaly		8x Account Login / Smart ID global week
Device User Change 16x 1week Global			Attribute Anomaly		16x Account Login / Smart ID global week
Device User Change 2x 1month Global			Attribute Anomaly		2x Account Login / Smart ID global month
Device User Change 4x 1month Global			Attribute Anomaly		4x Account Login / Smart ID global month
Device User Change 8x 1month Global			Attribute Anomaly		8x Account Login / Smart ID global month
Device User Change 16x 1month Global			Attribute Anomaly		16x Account Login / Smart ID global month
Device User Change 2x 1year Global			Attribute Anomaly		2x Account Login / Smart ID global year
Device User Change 4x 1year Global			Attribute Anomaly		4x Account Login / Smart ID global year
Device User Change 8x 1year Global			Attribute Anomaly		8x Account Login / Smart ID global year
Device User Change 16x 1year Global			Attribute Anomaly		16x Account Login / Smart ID global year
Device User Change 0x 1year Global			Attribute Anomaly	Yes	2x Account Login / Smart ID global year
Device Email Change 2x 1hour Global			Attribute Anomaly		2x Account Email / Smart ID global hour
Device Email Change 4x 1hour Global		-3.0	Attribute Anomaly		4x Account Email / Smart ID global hour
Device Email Change 8x 1hour Global			Attribute Anomaly		8x Account Email / Smart ID global hour
Device Email Change 16x 1hour Global			Attribute Anomaly		16x Account Email / Smart ID global hour
Device Email Change 2x 1week Global			Attribute Anomaly		2x Account Email / Smart ID global week
Device Email Change 4x 1week Global			Attribute Anomaly		4x Account Email / Smart ID global week
Device Email Change 8x 1week Global			Attribute Anomaly		8x Account Email / Smart ID global week
Device Email Change 16x 1week Global			Attribute Anomaly		16x Account Email / Smart ID global week
Device Email Change 2x 1month Global			Attribute Anomaly		2x Account Email / Smart ID global month
Device Email Change 4x 1month Global			Attribute Anomaly		4x Account Email / Smart ID global month
Device Email Change 8x 1month Global			Attribute Anomaly		8x Account Email / Smart ID global month
Device Email Change 16x 1month Global			Attribute Anomaly		16x Account Email / Smart ID global month
Device Email Change 2x 1year Global			Attribute Anomaly		2x Account Email / Smart ID global year
Device Email Change 4x 1year Global			Attribute Anomaly		4x Account Email / Smart ID global year
Device Email Change 8x 1year Global			Attribute Anomaly		8x Account Email / Smart ID global year
Device Email Change 16x 1year Global		-3.0	Attribute Anomaly		16x Account Email / Smart ID global year
Device Email Change 0x 1year Global			Attribute Anomaly	Yes	2x Account Email / Smart ID global year
Device Phone Change 2x 1hour Global			Attribute Anomaly		2x Account Telephone / Smart ID global hour
Device Phone Change 4x 1hour Global			Attribute Anomaly		4x Account Telephone / Smart ID global hour
Device Phone Change 8x 1hour Global			Attribute Anomaly		8x Account Telephone / Smart ID global hour
Device Phone Change 16x 1hour Global			Attribute Anomaly		16x Account Telephone / Smart ID global hour
Device Phone Change 2x 1week Global			Attribute Anomaly		2x Account Telephone / Smart ID global week
Device Phone Change 4x 1week Global			Attribute Anomaly		4x Account Telephone / Smart ID global week
Device Phone Change 8x 1week Global			Attribute Anomaly		8x Account Telephone / Smart ID global week
Device Phone Change 16x 1week Global			Attribute Anomaly		16x Account Telephone / Smart ID global week
Device Phone Change 2x 1month Global			Attribute Anomaly		2x Account Telephone / Smart ID global month
Device Phone Change 4x 1month Global			Attribute Anomaly		4x Account Telephone / Smart ID global month
Device Phone Change 8x 1month Global			Attribute Anomaly		8x Account Telephone / Smart ID global month
Device Phone Change 16x 1month Global			Attribute Anomaly		16x Account Telephone / Smart ID global month
Device Phone Change 2x 1year Global			Attribute Anomaly		2x Account Telephone / Smart ID global year
Device Phone Change 4x 1year Global		-3.0	Attribute Anomaly		4x Account Telephone / Smart ID global year
Device Phone Change 8x 1year Global		-3.0	Attribute Anomaly		8x Account Telephone / Smart ID global year
Device Phone Change 16x 1year Global		-3.0	Attribute Anomaly		16x Account Telephone / Smart ID global year
Device Phone Change 0x 1year Global			Attribute Anomaly	Yes	2x Account Telephone / Smart ID global year
Device Cookie Change 2x 1hour Global			Attribute Anomaly		2x Exact ID / Smart ID global hour
Device Cookie Change 4x 1hour Global			Attribute Anomaly		4x Exact ID / Smart ID global hour
Device Cookie Change 8x 1hour Global			Attribute Anomaly		8x Exact ID / Smart ID global hour
Device Cookie Change 16x 1hour Global			Attribute Anomaly		16x Exact ID / Smart ID global hour
Device Cookie Change 2x 1week Global			Attribute Anomaly		2x Exact ID / Smart ID global week
Device Cookie Change 4x 1week Global			Attribute Anomaly		4x Exact ID / Smart ID global week
Device Cookie Change 8x 1week Global			Attribute Anomaly		8x Exact ID / Smart ID global week
Device Cookie Change 16x 1week Global			Attribute Anomaly		16x Exact ID / Smart ID global week
Device Cookie Change 2x 1month Global			Attribute Anomaly		2x Exact ID / Smart ID global month
Device Cookie Change 4x 1month Global			Attribute Anomaly		4x Exact ID / Smart ID global month
Device Cookie Change 8x 1month Global			Attribute Anomaly		8x Exact ID / Smart ID global month
Device Cookie Change 16x 1month Global			Attribute Anomaly		16x Exact ID / Smart ID global month
Device Cookie Change 2x 1year Global			Attribute Anomaly		2x Exact ID / Smart ID global year
Device Cookie Change 4x 1year Global		-2.0	Attribute Anomaly		4x Exact ID / Smart ID global year
Device Cookie Change 8x 1year Global			Attribute Anomaly		8x Exact ID / Smart ID global year
Device Cookie Change 16x 1year Global		-10.0	Attribute Anomaly		16x Exact ID / Smart ID global year
Device Cookie Change 0x 1year Global		10.0	Attribute Anomaly	Yes	2x Exact ID / Smart ID global year
Device IP Change 2x 1hour Global			Attribute Anomaly		2x True IP / Smart ID global hour
Device IP Change 4x 1hour Global			Attribute Anomaly		4x True IP / Smart ID global hour
Device IP Change 8x 1hour Global			Attribute Anomaly		8x True IP / Smart ID global hour
Device IP Change 16x 1hour Global			Attribute Anomaly		16x True IP / Smart ID global hour
Device IP Change 2x 1week Global			Attribute Anomaly		2x True IP / Smart ID global week
Device IP Change 4x 1week Global			Attribute Anomaly		4x True IP / Smart ID global week
Device IP Change 8x 1week Global			Attribute Anomaly		8x True IP / Smart ID global week
Device IP Change 16x 1week Global			Attribute Anomaly		16x True IP / Smart ID global week
Device IP Change 2x 1month Global			Attribute Anomaly		2x True IP / Smart ID global month
Device IP Change 4x 1month Global			Attribute Anomaly		4x True IP / Smart ID global month
Device IP Change 8x 1month Global			Attribute Anomaly		8x True IP / Smart ID global month
Device IP Change 16x 1month Global			Attribute Anomaly		16x True IP / Smart ID global month
Device IP Change 2x 1year Global			Attribute Anomaly		2x True IP / Smart ID global year
Device IP Change 4x 1year Global			Attribute Anomaly		4x True IP / Smart ID global year
Device IP Change 8x 1year Global			Attribute Anomaly		8x True IP / Smart ID global year
Device IP Change 16x 1year Global			Attribute Anomaly		16x True IP / Smart ID global year
Device IP Change 0x 1year Global			Attribute Anomaly	Yes	2x True IP / Smart ID global year
Device Country Change 2x 1hour Global		-1.0	Attribute Anomaly		2x True IP Geo / Smart ID global hour
Device Country Change 4x 1hour Global		-10.0	Attribute Anomaly		4x True IP Geo / Smart ID global hour
Device Country Change 8x 1hour Global			Attribute Anomaly		8x True IP Geo / Smart ID global hour
Device Country Change 16x 1hour Global			Attribute Anomaly		16x True IP Geo / Smart ID global hour
Device Country Change 2x 1week Global			Attribute Anomaly		2x True IP Geo / Smart ID global week
Device Country Change 4x 1week Global			Attribute Anomaly		4x True IP Geo / Smart ID global week
Device Country Change 8x 1week Global			Attribute Anomaly		8x True IP Geo / Smart ID global week
Device Country Change 16x 1week Global			Attribute Anomaly		16x True IP Geo / Smart ID global week
Device Country Change 2x 1month Global			Attribute Anomaly		2x True IP Geo / Smart ID global month
Device Country Change 4x 1month Global			Attribute Anomaly		4x True IP Geo / Smart ID global month
Device Country Change 8x 1month Global			Attribute Anomaly		8x True IP Geo / Smart ID global month
Device Country Change 16x 1month Global			Attribute Anomaly		16x True IP Geo / Smart ID global month
Device Country Change 2x 1year Global			Attribute Anomaly		2x True IP Geo / Smart ID global year
Device Country Change 4x 1year Global		-2.0	Attribute Anomaly		4x True IP Geo / Smart ID global year
Device Country Change 8x 1year Global			Attribute Anomaly		8x True IP Geo / Smart ID global year
Device Country Change 16x 1year Global			Attribute Anomaly		16x True IP Geo / Smart ID global year
Device Country Change 0x 1year Global			Attribute Anomaly	Yes	2x True IP Geo / Smart ID global year
Device Remote Change 2x 1hour Global			Attribute Anomaly		2x Remote Desktop / Smart ID global hour
Device Remote Change 2x 1week Global			Attribute Anomaly		2x Remote Desktop / Smart ID global week
Device Remote Change 2x 1month Global			Attribute Anomaly		1x Remote Desktop / Smart ID global month
Device Remote Change 2x 1year Global			Attribute Anomaly		2x Remote Desktop / Smart ID global year
Device Remote Change 0x 1year Global			Attribute Anomaly	Yes	2x Remote Desktop / Smart ID global year
IP User Change 2x 1hour		-1.0	Attribute Anomaly		2x Account Login / True IP local hour
IP User Change 4x 1hour		-2.0	Attribute Anomaly		4x Account Login / True IP local hour
IP User Change 8x 1hour			Attribute Anomaly		8x Account Login / True IP local hour
IP User Change 16x 1hour		-7.0	Attribute Anomaly		16x Account Login / True IP local hour
IP User Change 2x 1week			Attribute Anomaly		2x Account Login / True IP local week
IP User Change 4x 1week			Attribute Anomaly		4x Account Login / True IP local week
IP User Change 8x 1week			Attribute Anomaly		8x Account Login / True IP local week
IP User Change 16x 1week			Attribute Anomaly		16x Account Login / True IP local week
IP User Change 2x 1month			Attribute Anomaly		2x Account Login / True IP local month
IP User Change 4x 1month			Attribute Anomaly		4x Account Login / True IP local month
IP User Change 8x 1month			Attribute Anomaly		8x Account Login / True IP local month
IP User Change 16x 1month			Attribute Anomaly		16x Account Login / True IP local month
IP User Change 2x 1year			Attribute Anomaly		2x Account Login / True IP local year
IP User Change 4x 1year			Attribute Anomaly		4x Account Login / True IP local year
IP User Change 8x 1year			Attribute Anomaly		8x Account Login / True IP local year
IP User Change 16x 1year			Attribute Anomaly		16x Account Login / True IP local year
IP User Change 0x 1year			Attribute Anomaly	Yes	2x Account Login / True IP local year
IP Device Change 2x 1hour Global			Attribute Anomaly		2x Smart ID / True IP global day
IP Device Change 4x 1hour Global			Attribute Anomaly		4x Smart ID / True IP global day
IP Device Change 8x 1hour Global			Attribute Anomaly		8x Smart ID / True IP global day
IP Device Change 16x 1hour Global			Attribute Anomaly		16x Smart ID / True IP global day
IP Device Change 2x 1week Global			Attribute Anomaly		2x Smart ID / True IP global week
IP Device Change 4x 1week Global			Attribute Anomaly		4x Smart ID / True IP global week
IP Device Change 8x 1week Global			Attribute Anomaly		8x Smart ID / True IP global week
IP Device Change 16x 1week Global			Attribute Anomaly		16x Smart ID / True IP global week
IP Device Change 2x 1month Global			Attribute Anomaly		2x Smart ID / True IP global month
IP Device Change 4x 1month Global			Attribute Anomaly		4x Smart ID / True IP global month
IP Device Change 8x 1month Global			Attribute Anomaly		8x Smart ID / True IP global month
IP Device Change 16x 1month Global			Attribute Anomaly		16x Smart ID / True IP global month
IP Device Change 2x 1year Global			Attribute Anomaly		2x Smart ID / True IP global year
IP Device Change 4x 1year Global			Attribute Anomaly		4x Smart ID / True IP global year
IP Device Change 8x 1year Global			Attribute Anomaly		8x Smart ID / True IP global year
IP Device Change 16x 1year Global			Attribute Anomaly		16x Smart ID / True IP global year
IP Device Change 0x 1year Global			Attribute Anomaly	Yes	2x Smart ID / True IP global year
Value High			Transaction Amount Exceeds Threshold		> 1000.00 USD
Value Low			Transaction Amount Exceeds Threshold		< 100 USD
Value Medium			IF	Yes	Value High \| Value Low
Device ID Missing			No Device ID		No Device ID
Time_On_Page -500ms		-30.0	Condition		Time spent on page less than 500
Device Mismatch		-1.0	Condition		Smart ID not equal to Exact ID
Resolution 100x100		-5.0	Condition		Screen Res equal to 100x100
Resolution Anomaly		-5.0	Condition		Screen Res Anomaly equal to yes
Aspect_Ratio Anomaly			Condition		Aspect Ratio Anomaly equal to yes
Browser Anomaly		-1.0	Condition		Browser Anomaly is present
OS Anomaly		-1.0	Condition		OS Anomaly is present
Flash Anomaly			Condition		Flash Anomaly is present
Image Anomaly			Condition		Image Anomaly is present
Color Anomaly			Condition		Screen Colour Depth less than or equal to 8
Session Anomaly		-1.0	Session Anomaly		#
Cookie Anomaly		-1.0	Cookie Anomaly		# Custom_Match: custom_match_1, Generate_Anomaly_Flag: no, Threshold: 5, VelocityPeriod: Last_7_days
Cookie-OS Vel 2x 1day			Multiple Attribute Velocity		2x Exact ID - HTTP OS SignatureLast_day)
Cookie Copy OS			Attribute Anomaly		2x Custom Match ID 7 / Exact ID global day
Cookie-Browser Vel 2x 1day			Multiple Attribute Velocity		2x Exact ID - Browser StringLast_day)
Cookie Copy Browser			Attribute Anomaly		2x Custom Match ID 8 / Exact ID global day
Cookie-Browser Change 3x 1day Global			Attribute Anomaly		3x Browser String Hash / Exact ID global day
Cookie-Resolution Change 3x 1day Global			Attribute Anomaly		3x Screen Res / Exact ID global day
Cookie Copy		-3.0	IF		Cookie Copy OS \| Cookie Copy Browser
GPS Address Distance 1km			Proximity	Yes	> 1 Km hardware_lat_long - account_address_zip_lat_long
GPS Address Distance 10km			Proximity	Yes	> 10 Km hardware_lat_long - account_address_zip_lat_long
GPS Address Distance 100km			Proximity	Yes	> 100 Km hardware_lat_long - account_address_zip_lat_long
GPS Address Distance 1000km		-1.0	Proximity	Yes	> 1000 Km hardware_lat_long - account_address_zip_lat_long
IP Address Distance 1km			Proximity	Yes	> 1 Km true_ip - account_address_zip_lat_long
IP Address Distance 10km		2.0	Proximity	Yes	> 10 Km true_ip - account_address_zip_lat_long
IP Address Distance 100km		1.0	Proximity	Yes	> 100 Km true_ip - account_address_zip_lat_long
IP Address Distance 1000km			Proximity	Yes	> 1000 Km true_ip - account_address_zip_lat_long
IP Wifi Distance 1km			Proximity	Yes	> 1 Km true_ip - agent_wps_lat_long
IP Wifi Distance 10km			Proximity	Yes	> 10 Km true_ip - agent_wps_lat_long
IP Wifi Distance 100km			Proximity	Yes	> 100 Km true_ip - agent_wps_lat_long
IP Wifi Distance 1000km			Proximity	Yes	> 1000 Km true_ip - agent_wps_lat_long
IP GPS Distance 1km			Proximity	Yes	> 1 Km true_ip - hardware_lat_long
IP GPS Distance 10km			Proximity	Yes	> 10 Km true_ip - hardware_lat_long
IP GPS Distance 100km		1.0	Proximity	Yes	> 100 Km true_ip - hardware_lat_long
IP GPS Distance 1000km			Proximity	Yes	> 1000 Km true_ip - hardware_lat_long
IP DNS Distance 1km			Proximity	Yes	> 1 Km true_ip - dns_ip
IP DNS Distance 10km			Proximity	Yes	> 10 Km true_ip - dns_ip
IP DNS Distance 100km			Proximity	Yes	> 100 Km true_ip - dns_ip
IP DNS Distance 1000km			Proximity	Yes	> 1000 Km true_ip - dns_ip
IP Proxy Distance 1km			Proximity	Yes	> 1 Km true_ip - proxy_ip
IP Proxy Distance 10km			Proximity	Yes	> 10 Km true_ip - proxy_ip
IP Proxy Distance 100km			Proximity	Yes	> 100 Km true_ip - proxy_ip
IP Proxy Distance 1000km			Proximity	Yes	> 1000 Km true_ip - proxy_ip
Device IP Moved 100km 1hour Global		-1.0	Distance Traveled		> 100 Km True IP / Smart ID global hour
Device IP Moved 300km 1hour Global		-5.0	Distance Traveled		> 300 Km True IP / Smart ID global hour
Device IP Moved 900km 1hour Global		-20.0	Distance Traveled		> 900 Km True IP / Smart ID global hour
Device IP Moved 100km 1week Global			Distance Traveled		> 100 Km True IP / Smart ID global week
Device IP Moved 300km 1week Global			Distance Traveled		> 300 Km True IP / Smart ID global week
Device IP Moved 900km 1week Global		-3.0	Distance Traveled		> 900 Km True IP / Smart ID global week
Device IP Moved 100km 1month Global			Distance Traveled		> 100 Km True IP / Smart ID global month
Device IP Moved 300km 1month Global			Distance Traveled		> 300 Km True IP / Smart ID global month
Device IP Moved 900km 1month Global		-1.0	Distance Traveled		> 900 Km True IP / Smart ID global month
Device input_IP Moved 800km 1hour Global		-15.0	Distance Traveled		> 800 Km Input IP / Smart ID global hour
Device DNS Moved 800km 1hour Global			Distance Traveled		> 800 Km DNS IP / Smart ID global hour
Email input_IP Moved 800km 1hour Global		-15.0	Distance Traveled		> 800 Km Input IP / Account Email global hour
Email IP Moved 800km 1hour Global			Distance Traveled		> 800 Km True IP / Account Email global hour
Email DNS Moved 800km 1hour Global			Distance Traveled		> 800 Km DNS IP / Account Email global hour
Geo Match Ofac		-1.0	True Geo Match		TIP GEO = Belarus, Venezuela, Somalia, Zimbabwe, Myanmar, Ivory Coast, Central African Republic, Democratic Republic of the Congo, Cuba, Syria, South Sudan, North Korea, Yemen, Libya, Iran, Ukraine
Geo Mismatch Timezone/IP		-1.0	Time Zone/True Geo Mismatch		Mismatch TZ GEO Tolerance: 0
Geo Mismatch Proxy/IP		-1.0	Proxy Geo/True Geo Mismatch		Proxy Geo/True Geo Mismatch
Mobile			Condition		Agent Type contains browser_mobile \| Agent Type contains agent_mobile
Brand Apple			Condition		Device Brand contains Apple
Brand Samsung			Condition		Device Brand contains Samsung
Brand Huawei			Condition		Device Brand contains Huawei
Brand Xiaomi			Condition		Device Brand contains Xiaomi
Brand Oppo			Condition		Device Brand contains Oppo
Brand LG			Condition		Device Brand contains HTC
Brand Lenovo			Condition		Device Brand contains Lenovo
Brand Motorola			Condition		Device Brand contains Motorola
Brand Nokia			Condition		Device Brand contains Nokia
Brand Other			IF	Yes	Brand Apple \| Brand Samsung \| Brand Huawei \| Brand Xiaomi \| Brand Oppo \| Brand LG \| Brand Lenovo \| Brand Motorola \| Brand Nokia
OS Windows			Condition		OS equal to Windows \| OS equal to Windows Mobile
OS Mac			Condition		OS equal to OS X
OS Linux		-1.0	Condition		OS equal to Linux
OS Android			Condition		OS equal to Android
OS iOS			Condition		OS contains iOS
OS Other			IF	Yes	OS Windows \| OS Mac \| OS Linux \| OS Android \| OS iOS
Computer			Condition		Agent Type contains browser_computer \| Agent Type contains agent_computer \| Agent Type contains agent_sdk
App			Condition		Agent Type contains agent_computer \| Agent Type contains agent_mobile \| Agent Type contains agent_sdk
Browser			Condition		Agent Type contains browser_computer \| Agent Type contains browser_mobile
Browser Chrome			Condition		Browser equal to Chrome
Browser Firefox		-5.0	Condition		Browser equal to FireFox
Browser Safari			Condition		Browser equal to Safari
Browser Opera			Condition		Browser equal to Opera \| Browser equal to Opera Mini
Browser Edge			Condition		Browser equal to Edge
Browser IE			Condition		Browser equal to Internet Explorer
Browser Other		-2.0	IF	Yes	Browser Chrome \| Browser Firefox \| Browser Safari \| Browser Opera \| Browser Edge \| Browser IE
Browser Mode Private		-10.0	Condition		Private Browsing equal to yes
Resolution 640x360			Condition		Screen Res equal to 640x360
Resolution iPhone			Condition		Screen Res equal to 480x320 \| Screen Res equal to 568x320 \| Screen Res equal to 667x375 \| Screen Res equal to 736x414 \| Screen Res equal to 812x375
Resolution SVGA-XGA			Condition		Screen Res equal to 800x600 \| Screen Res equal to 1024x600 \| Screen Res equal to 1024x768 \| Screen Res equal to 1152x864
Resolution HD			Condition		Screen Res equal to 1280x720 \| Screen Res equal to 1280x1024 \| Screen Res equal to 1360x768 \| Screen Res equal to 1366x768 \| Screen Res equal to 1440x900 \| Screen Res equal to 1600x900 \| Screen Res equal to 1600x1050
Screen Resolution FHD			Condition		Screen Res equal to 1920x1080
Resolution QHD-UHD			Condition		Screen Res equal to 2560x1440
Resolution Other		-1.0	IF	Yes	Resolution 640x360 \| Resolution iPhone \| Resolution SVGA-XGA \| Resolution HD \| Screen Resolution FHD \| Resolution QHD-UHD
Time Day			Date Time Check		# TimeEnd: 22:00, TimeSource: Africa/Lagos, TimeStart: 07:00
Time Night			Date Time Check	Yes	# TimeEnd: 22:00, TimeSource: Africa/Lagos, TimeStart: 07:00
Day Work			Date Time Check		# Days: monday,tuesday,wednesday,thursday,friday, TimeSource: Africa/Lagos
Day Weekend			Date Time Check		# Days: sunday,saturday, TimeSource: Africa/Lagos
Work Night			IF		Time Night & Day Work
Value 1x StdVar User	On Demand	-2.0	SmartRules		# Expression: $att:transaction_amount$ >= ($var:User_Val_Avg$ + ($var:User_Val_StdVar$ / 2))
Value 2x StdVar User	On Demand	-5.0	SmartRules		# Expression: $att:transaction_amount$ >= ($var:User_Val_Avg$ + $var:User_Val_StdVar$)
Value 1x StdVar Dest	On Demand	-3.0	SmartRules		# Expression: $att:transaction_amount$ >= ($var:Dest_Val_Avg$ + ($var:Dest_Val_StdVar$ / 2))
Value 2x StdVar Dest	On Demand	-7.0	SmartRules		# Expression: $att:transaction_amount$ >= ($var:Dest_Val_Avg$ + $var:Dest_Val_StdVar$)
Value 1x Max User	On Demand	-5.0	SmartRules		# Expression: $att:transaction_amount$ >= $var:User_Val_Max$

Example

Below is a complete example of a possible output using ThreatMetrix.

{
  "id": "5b54d59f-a747-4913-ae03-c4ba54b79bde",
  "name": "Evaluate_Risk",
  "status": "Finished",
  "state": {
    "result": {
      "code": "0",
      "message": "Risk operation completed",
      "type": "Risk_Response",
      "object": {
        "risk": {
          "status": "SUCCESS",
          "decision": {
            "access": "allowed",
            "auth": [
              {
                "type": "password"
              }
            ]
          },
          "decisionDetails": {
            "threatmetrix": [
              {
                "policyName": "gto_atpLogin",
                "result": {
                  "account_email": "dev@new.com",
                  "account_email_activities": [
                    "_AUTH_FAILED",
                    "_CHALLENGE_PASSED",
                    "_FRAUD_CONF"
                  ],
                  "account_email_attributes": [
                    "_AUTH_FAILED",
                    "_CHALLENGE_PASSED",
                    "_FRAUD_CONF"
                  ],
                  "account_email_domain": "new.com",
                  "account_email_first_seen": "2017-09-08",
                  "account_email_last_event": "2019-03-21",
                  "account_email_last_update": "2019-03-21",
                  "account_email_result": "success",
                  "account_email_score": "0",
                  "account_email_worst_score": "0",
                  "account_number": "df23423234234gew352344444",
                  "account_number_first_seen": "2017-09-08",
                  "account_number_last_event": "2019-03-21",
                  "account_number_last_update": "2019-03-21",
                  "account_number_result": "success",
                  "account_number_score": "0",
                  "account_number_worst_score": "0",
                  "agent_type": "browser_computer",
                  "api_call_datetime": "2019-03-21 10:31:13.326",
                  "api_version": "10.0.1",
                  "browser": "Firefox",
                  "browser_language": "es,es-ES;q=0.8,en;q=0.7,en-US;q=0.5,fr;q=0.3,fr-FR;q=0.2",
                  "browser_string": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0",
                  "browser_string_hash": "02e58c64d05cf11072959e53424d4345",
                  "browser_version": "65",
                  "canvas_hash": "ed26d6fd360dd538cca3a93f36e3a7f446e62de1",
                  "css_image_loaded": "yes",
                  "detected_fl": "yes",
                  "device_first_seen": "2019-03-18",
                  "device_id": "c281100a232946dbaccf47901bad8fa8",
                  "device_id_confidence": "100",
                  "device_last_event": "2019-03-21",
                  "device_last_update": "2019-03-21",
                  "device_match_result": "success",
                  "device_result": "success",
                  "device_score": "0",
                  "device_worst_score": "0",
                  "digital_id": "58853dcf8d4a4c2f8e218c95a1af2dad",
                  "digital_id_activities": [
                    "_AUTH_FAILED",
                    "_AUTH_PASSED"
                  ],
                  "digital_id_attributes": [
                    "_AUTH_FAILED",
                    "_AUTH_PASSED"
                  ],
                  "digital_id_confidence": "6395",
                  "digital_id_confidence_rating": "low",
                  "digital_id_first_seen": "2017-09-08",
                  "digital_id_last_event": "2019-03-21",
                  "digital_id_last_update": "2019-03-21",
                  "digital_id_result": "success",
                  "digital_id_trust_score_rating": "low",
                  "digital_id_trust_score_reason_code": [
                    "_ts_neutral_conf_score",
                    "_ts_high_entity_age_score",
                    "_ts_gbl_high_vel",
                    "_ts_low_did_age_score",
                    "_ts_very_long_did_distance",
                    "_ts_low_graph_complex",
                    "_ts_did_3_or_more_trueip",
                    "_ts_did_2_or_more_inputip"
                  ],
                  "dns_ip": "1.0.0.1",
                  "dns_ip_assert_history": "NEGATIVE_HISTORY",
                  "dns_ip_attributes": [
                    "_LOGIN_FAILED",
                    "_WATCH",
                    "_LOGIN_FAILED",
                    "_LOGIN_PASSED"
                  ],
                  "dns_ip_city": "la plaine-saint-denis",
                  "dns_ip_connection_type": "tx",
                  "dns_ip_geo": "FR",
                  "dns_ip_hosting_facility": "true",
                  "dns_ip_isp": "zscaler switzerland gmbh",
                  "dns_ip_latitude": "11.22222",
                  "dns_ip_line_speed": "high",
                  "dns_ip_longitude": "1.22222",
                  "dns_ip_organization": "zscaler inc.",
                  "dns_ip_postal_code": "12345",
                  "dns_ip_region": "seine-saint-denis",
                  "dns_ip_routing_type": "fixed",
                  "enabled_ck": "yes",
                  "enabled_fl": "no",
                  "enabled_im": "yes",
                  "enabled_js": "yes",
                  "event_type": "login",
                  "flash_anomaly": "yes",
                  "fuzzy_device_activities": "_AUTH_PASSED",
                  "fuzzy_device_attributes": "_AUTH_PASSED",
                  "fuzzy_device_first_seen": "2019-02-19",
                  "fuzzy_device_id": "16123432432d4912a6d8876ef082f832",
                  "fuzzy_device_id_confidence": "100.00",
                  "fuzzy_device_last_event": "2019-03-21",
                  "fuzzy_device_last_update": "2019-03-21",
                  "fuzzy_device_match_result": "success",
                  "fuzzy_device_result": "success",
                  "fuzzy_device_score": "0",
                  "fuzzy_device_worst_score": "0",
                  "headers_name_value_hash": "97b61ffbde7d8179fce5b47db82f6996",
                  "headers_order_string_hash": "89dbb875f3f233f4133bcb076f17eda1",
                  "honeypot_fingerprint": "54930c2d59e3e56e715547df911c540222045fc8",
                  "honeypot_fingerprint_check": "true",
                  "honeypot_fingerprint_match": "match_exact",
                  "http_os_sig_adv_mss": "1448",
                  "http_os_sig_rcv_mss": "582",
                  "http_os_sig_snd_mss": "1448",
                  "http_os_signature": "FreeBSD",
                  "http_referer": "32K5254654HfL!2389nhcbACHIbnLM7",
                  "http_referer_domain": "ebankingDemo",
                  "http_referer_url": "https://ebankingDemo",
                  "image_loaded": "yes",
                  "input_ip_address": "127.0.0.1",
                  "js_browser": "Firefox 65",
                  "js_browser_string": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0",
                  "js_browser_string_hash": "02e58c64d05cf11875449e53424d4345",
                  "js_fonts_hash": "6cacae1e7b8a30875856b9a255ff6aaf",
                  "js_fonts_number": "214",
                  "js_os": "Windows 7",
                  "mime_type_hash": "cf79efbf4ca0d37687623d23394e357e",
                  "mime_type_number": "2",
                  "org_id": "12313213123",
                  "os": "Windows",
                  "os_anomaly": "yes",
                  "os_version": "7",
                  "page_time_on": "20226",
                  "plugin_flash": "32.0 r0",
                  "plugin_hash": "b11f22ac6eb581fd9cc1f62d7d210e5f",
                  "plugin_number": "1",
                  "policy": "gto_atplogin",
                  "policy_details_api": "{\"policy_detail_api\":[{\"type\":\"champion\",\"id\":\"0\",\"customer\":{\"score\":\"0\",\"pvid\":\"1154044\",\"review_status\":\"reject\",\"risk_rating\":\"high\"}}]}",
                  "policy_score": "0",
                  "primary_industry": "banking",
                  "private_browsing": "no",
                  "profiled_domain": "ebankindDemo",
                  "profiled_url": "https://ebankindDemo/partners/mybank/login",
                  "profiling_datetime": "1553164253",
                  "request_duration": "65",
                  "request_id": "8fb85488-80c7-4c53-9873-5725990e38e4",
                  "request_result": "success",
                  "review_status": "reject",
                  "risk_rating": "high",
                  "screen_color_depth": "24",
                  "screen_res": "1600x900",
                  "secondary_industry": "retail",
                  "service_type": "session-policy",
                  "session_id": "5d0bf85b-3bd9-4f15-8310-49b57e2110ce",
                  "session_id_query_count": "1",
                  "summary_risk_score": "0",
                  "system_state": "1552521857",
                  "time_zone": "60",
                  "time_zone_dst_offset": "60",
                  "tmx_reason_code": [
                    "_IP_GBL_VEL_10_72_80_80",
                    "_IP_GBL_AGE_GT_3MTHS",
                    "_TrueIP_Org_Global_Whitelist",
                    "_InputIP_Global_Whitelist"
                  ],
                  "tmx_risk_rating": "neutral",
                  "tmx_summary_reason_code": [
                    "Device_Negative_History",
                    "Identity_Negative_History",
                    "Device_Spoofing"
                  ],
                  "tmx_variables": "{\"_accemail_gbl_velocity_hour\":\"1\",\"_accemail_local_velocity_hour\":\"1\",\"_acctemails_per_exactid_hour\":\"1\",\"_acnt_login_per_exactid_hour\":\"0\",\"_acnt_login_per_smartid_hour\":\"0\",\"_acntemails_per_exactid_gbl_hour\":\"1\",\"_acntemails_per_smartid_hour\":\"1\",\"_cc_per_exactid_hour\":\"0\",\"_cc_per_smartid_gbl_hour\":\"0\",\"_cc_per_smartid_hour\":\"0\",\"_exactid_gbl_velocity_hour\":\"1\",\"_exactid_local_velocity_hour\":\"1\",\"_exactid_per_email_gbl_hour\":\"1\",\"_smartid_gbl_velocity_hour\":\"0\",\"_smartid_local_velocity_hour\":\"0\"}",
                  "true_ip": "165.225.76.94",
                  "true_ip_activities": [
                    "_AUTH_FAILED",
                    "_AUTH_PASSED",
                    "_CHALLENGE_PASSED"
                  ],
                  "true_ip_assert_history": "NEGATIVE_HISTORY",
                  "true_ip_attributes": [
                    "_AUTH_PASSED",
                    "_CHALLENGED",
                    "_LOCK",
                    "_LOGIN_PASSED",
                    "_WATCH",
                    "_LOGIN_PASSED"
                  ],
                  "true_ip_city": "la plaine-saint-denis",
                  "true_ip_connection_type": "tx",
                  "true_ip_first_seen": "2015-08-14",
                  "true_ip_geo": "FR",
                  "true_ip_hosting_facility": "true",
                  "true_ip_isp": "zscaler switzerland gmbh",
                  "true_ip_last_event": "2019-03-21",
                  "true_ip_last_update": "2019-03-21",
                  "true_ip_latitude": "11.22222",
                  "true_ip_line_speed": "high",
                  "true_ip_longitude": "1.222222",
                  "true_ip_organization": "zscaler inc.",
                  "true_ip_organization_type": "Internet Hosting Services",
                  "true_ip_postal_code": "93534",
                  "true_ip_region": "seine-saint-denis",
                  "true_ip_result": "success",
                  "true_ip_routing_type": "fixed",
                  "true_ip_score": "-5",
                  "true_ip_worst_score": "-100",
                  "turn_os_sig_raw": "165.225.76.94~4:56:0:1460:65535,5:mss,nop,ws,sok,ts:df,id+:0|4:57:0:0:2081,0:nop,nop,ts:df,id+,ts2+:0",
                  "turn_os_sig_ttl": "57",
                  "turn_os_signature": "FreeBSD",
                  "turn_system_state": "1552521857",
                  "turn_tcp_tstmp_rate": "100",
                  "ua_browser": "firefox 65.0",
                  "ua_browser_alt": "Firefox",
                  "ua_browser_version_alt": "65.0",
                  "ua_os": "win7",
                  "ua_os_alt": "Windows",
                  "ua_os_version_alt": "7",
                  "ua_platform": "firefox 65.0",
                  "webgl_hash": "ab4329fb41168f8d543557fa9a2e6e11c74e2ff2",
                  "webrtc_external_ip": "1.0.0.1",
                  "webrtc_internal_ip": "1.0.0.1"
                }
              }
            ]
          },
          "policy": {
            "id": "fdeba170-1d63-36e7-f36f-844c31b3003e",
            "name": "login",
            "scenario": {
              "id": "0011c00d-b48b-b82c-4a66-1d394b64ff67",
              "name": "TMX example"
            }
          }
        }
      }
    }
  }
}

JSON relative paths

In the tables of this page, the JSON path columns contain relative JSON paths.

For easier readability, we have removed the beginning of the JSON path since it is common to all paths. This part is shown below.

You can also check the example section to see a complete response.

{
  "state": {
    "result": {
      "object": {
        "risk": {
          "decisionDetails": {
            "threatmetrix": [
              {
                "result": {
                    "JSON RELATIVE PATH"
                }
              }
            ]
          }
        }
      }
    }
  }
}

Suggest A Change

ThreatMetrix

Multiple policies

Important elements

Flags

Custom policies

Example

JSON relative paths

On this page