Let's deploy the model from the previous section so it can start flagging transactions on new data.
- From either previous screen (or by going to the Detection Models page and selecting the Model from the Validating Models tab):
- Select Activate Model:
- This will bring up a prompt where you can select a
End Timefor the model.
There is also an option to run this model in
Shadow Mode, also known as silent mode (where alerts are generated but they are not sent into alert queues for agent review - this is good if you want to further validate a rule/model).
- In this case, select a start time that is about 1 hour from the current time. You need to give yourself at least 1 hour for the next sections where we will feed additional transactions into the system that will trigger this rule.
In this example, our current time was 10AM so we choose to start the model at 11AM.
- Click Activate. A new page will load with the now active Model.
The rule will run every 12 hours as directed, it will start running for the first time at your selected
The rule will run until the
End Time and then de-activate itself.
An active model has 3 basic options available in the action menu:
- Execute Model - This will run an external model immediately - This button doesn't do anything for scenario and DMB rules
- Deactivate Model - This will turn OFF the model
- Duplicate Model - This will duplicate the current model**
- You can head over to the execution tab of this model to check that it has not yet started:
- A quick look at a live models. You can always find your model in the Detection Model page under the Live Models tab:
You can scroll through each tab to view information about your model:
- The Summary tab gives a glimpse of the model performance
- The Content tab shows a recap of the model logic
- The Triggered Alerts tab links to any generated alerts by this model
- The Validations tab shows the information from the model validation phase
- The Executions tab is a rundown of every time the model was executed by Unit21 and the amount of alerts generated
- The Whitelist tab displays any entities that have been whitelisted from this rule
- In the Notes tab, custom notes can be added to the model by agents
Let's add more dummy transaction to our system so our model gets triggered and generates an alert.
Updated 5 months ago