When a model / rule flags a transaction or action event, it generates an alert.
The alert is then sent into an alert queue. The team of agents assigned to that alert queue are able to view and investigate the alert.
team P0alert queue.
- Agent Grabriela Smith consumes from the
team P0alert queue and investigates
If escalation is necessary, the alert can be turned into a case.
Unit21 will not create a new alert if there is already an OPEN alert for that entity.
If there is already an open alert for entity A from rule B, any new transactions flagged for entity A by rule B will be added under the Hits tab in the existing alert.
It is important to close old alerts so that rules can generate new alerts for new transactions!
Otherwise new transactions that are flagged may end up getting lost in old unclosed alerts.
Alerts offer many possibilities for action, all of which can be managed from the Alerts pane of the Unit21 dashboard.
The Alerts page is the first step in the workflow for an agent. Each day, an agent logs into the dashboard and receives a new set of alerts to investigate:
The agents can request more alerts to work by using the Get More Alerts button.
Agents will work on alerts that are in their alert queue; see the Alert Queues section to learn more.
Simply click on an alert in the table to start the investigation process.
Alerts are the first step in the case management component of the Unit21 platform. During the investigation, agents can assign investigators, add notes, and upload media.
Each alert is identifiable by an
alert_id (Alert ID).
When an agent investigates an alert, they can also find data about:
- The underlying rule and the transactions that triggered the rule
- Associated alerts, cases, and reports involving the flagged entities
- Info on all entities and instruments flagged
As an agent investigates the alert, they can:
- Review associated entities, alerts, cases, and reports
- Add documents to the alert
- Add notes to the alert
- Add tags to the alert
- Work through the investigation checklist
- Re-assign or re-queue the alert through default or workflow buttons
- Resolve (dispose, escalate, transfer, close...) the alert through workflow buttons
Alert State -- Alerts have two states:
CLOSED. If needed, a closed alert can be reopened.
Alert Investigation Checklist -- The investigation checklist is programmable. The checklist is a set of steps an agent must follow to resolve an alert.
Alert Disposition -- Alerts can have dispositions such as "false positive" that define and classify the outcome of the agents' investigation.
Alert Deadline -- Alerts can have deadlines so that agents have a clear due date for their investigation.
Alert Audit Trail -- Whenever an agent updates an alert (adds documents, tags, sub-dispositions...) the action is logged automatically in the alert’s audit trail.
Alert Workflows -- Alerts can be escalated, transferred between agents, closed, opened, turned into a case, whitelisted, de-escalated, tagged and more using programmable workflow buttons.
Administrators can view all alerts in all queues under the Admin tab of the Alert page:
Updated 3 months ago