Essential rules

This page documents the Essential rules available in OneWelcome Identity Platform Risk Management.

Device profiling

Detect usual device

Checks whether the device was used by the user at least value times over the last value hours | days | weeks | months.

Detect usual device with authentication method

Checks whether the device was used by the user at least value times over the last value hours | days | weeks | months with a specific authentication method.

Detect first time used device

Checks whether the device is used for the first time.

User behavior analysis

Check the number of failed user authentication

Checks whether the user failed to authenticate at least value times over the last value hours | days | weeks | months.

Check the number of successful user authentication

Checks whether the user authenticated successfully at least value times over the last value hours | days | weeks | months.

Check the number of consecutive failed user authentication

Checks whether the user consecutively failed to authenticate at least value times.

Detect first time user

Checks whether this is the first visit for a specific user.

Device

Browser and version

• Browser name is one of:
  • Firefox
  • Internet Explorer
  • Chrome
  • Edge
  • Opera
  • Safari
  • Android browser
• Version comparison: < value or > value

OS name

OS name is one of:

• Windows
• Android
• iOS
• macOS
• Linux
• Windows mobile

Screen size

• Width: value
• Height: value

Geolocation

Detect change of country

Checks whether the user is connecting from a different country than the previous successful authentication.

Options:

• Lookback window: over the last value hours | days | weeks | months
• Include anonymous IP (check box)

Check country of connection

Checks whether the connection country is included or excluded from a country list (multi-select with search).

Option:

• Include anonymous IP (check box)

IP intelligence

Check connection IP address

Checks whether the connection IP is included or excluded.

Check anonymized IP address

Detects whether the IP address is anonymized:

• By any method
• By TOR node
• Detect if IP address is not anonymized