How to create a Dynamic Model

To create a Dynamic Model (Rule):

  1. Head over to Detection Models.
  2. Click the "+ Create Dynamic Model" button:
  1. Select if the model (rule) is to find a fraudulent entity or instrument:
  1. You can either select from existing templates or from scratch.
  1. Now you can define the logic for the Formula that will catch suspicious transactions and entities/instruments:

To learn how to create a Formula, refer to the Variable and Trigger Condition sections.


Once you are satisfied click "Next".

  1. Name your model and describe it accurately.

If you want the alerts to be tagged upon creation, you can select or create a tag.

  1. Select a time range for this rule to be validated as well as a frequency:

Please note that some models will not require an execution interval.

A calendar breakdown for the validation time-frame will pop up.


The time range was roughly 1 month and the frequency was every 2 weeks. This means the model will run on 3 windows worth of data.

When you are ready, click "Validate".

  1. Patiently wait with the rule is being validated against data from the selected date range.


This action is asynchronous!

If you want, you can leave this page and return later when the validation is done. You do not need to keep this window open.

If you lost your tab or closed the window, you can always find your rule in the Validating Models tab of the Detection Modeling page:

  1. Analyze the results of the validation:

The validation results will showcase any flagged transaction and generate a sample alert for your review.

If you are satisfied with the results of your model, you have three options:

  • Delete the Model - This will delete the model and validation results permanently and is NOT reversible.
  • Duplicate the Model - This will duplicate the model so that you can make changes to since it is NOT possible to edit a model AFTER validation.
  • Activate the Model - This will launch the model live.
  1. When you activate a model, a pop up will appear:

A this point you can:

  • Optionally select shadow mode so that the rule will run but not generate alerts
  • Select a start time (you can start in the past, present or future)
  • Optionally elect an end time (so that the rule doesn't run forever)
  • Optionally select a queue that all alerts generated by the rule will automatically go into