How to create a Scenario Model

To create a Scenario Model (Rule):

1. Head over to Detection Models.
2. Click the "+ Create Scenario Model" button:

3. Select the most appropriate scenario for your needs. See Scenario Models to learn more.

4. Now you can define the logic for the scenario you selected by filling out the sentence:

In the example below, we selected the "Simple Statistics" Scenario. The logic is as follows: Flag entities that have a sum of transaction amount in 1 day >= 400.

5. The logic is now complete but we can use the funnel icons to add additional filters:

You can click on the funnel and apply the logic of your choice:

In this example, we included only one entity in the model logic. The filter is active so the funnel icon is dark:

6. Finally you need to choose if you want this rule to group the results by entity or by hit:

📘

You can choose to group your alerts by entity/instrument or by hit.

• Grouping by hit will generate an alert if a transaction or group of transactions trigger your model
  • Grouping by entity/instrument will generate a single alert for all transaction(s) that involve the same entity/instrument

See Execution and Alert Limits to learn more.

Once you are satisfied click "Next".

7. Name your model and describe it accurately:

If you want the alerts to be tagged upon creation, you can select or create a tag.

8. Select a time range for this rule to be validated as well as a frequency:

You first need to select the start time and end time for the validation window of this rule.

In the example we selected 5/24/22 10AM to 6/23/22 6AM as our window. All the transactions received by Unit21 during that time frame will be used to validate the logical accuracy of this new rule.

Then we selected the execution interval which is how often the rule is run during the validation window. In the example, we want the rule to run every hour. Because the validation window is 1 month and the rule runs hourly, Unit21 runs the rule 717 times to validate it.

A calendar breakdown for the validation time-frame will pop up.

Not all scenarios will require an execution interval.

📘

Scenario based rules have 3 running states, WINDOWS, NON-WINDOWED, and ALL TIME.

See Execution Windows to learn more.

When you are ready, click "Validate".

9. Patiently wait with the rule is being validated against data from the selected date range.

🚧

This action is asynchronous!

If you want, you can leave this page and return later when the validation is done. You do not need to keep this window open.

10. Now it is time to review the results. If you kept the window open, the results will appear in the window. If you did not, simply go to Detection Models > Validating Models and select your Model from the list.

❗️

I don't see any graphs in my validation results!

If you don't see some of the visual items, it means your validation window was too large and we cannot display all of the information in your Dashboard. There is an option for you to download the data and graph it offline.

The Content section gives a review of your Model Formula with the Variables and Trigger Conditions.

The Transactions Histogram is a calendar view of all transactions (and the amount exchanged in the transaction) over the validation timeframe.

The Widget windows also give a quick view of the number of entities, transactions, alerts, and instruments flagged.

The Sample Alerts is a breakdown of the entities and all the relevant information regarding these entities flagged by your model during validation.

You have the option to export the results at the bottom of the page.

11. If you are satisfied with the results of your model, you have three options:

• Delete the Model - This will delete the model and validation results permanently and is NOT reversible.
• Duplicate the Model - This will duplicate the model so that you can make changes to since it is NOT possible to edit a model AFTER validation.
• Activate the Model - This will launch the model live.

12. When you activate a model, a pop up will appear:

A this point you can:

• Optionally select shadow mode so that the rule will run but not generate alerts
• Select a start time (you can start in the past, present or future)
• Optionally elect an end time (so that the rule doesn't run forever)
• Optionally select a queue that all alerts generated by the rule will automatically go into