Risk signal sources

A risk signal source defines the risk data that a policy can evaluate. Create a source instance from one of the available built-in source types, configure how its data maps to risk levels, then add that source to one or more risk policies.

The following built-in source types are available:

• Geolocation: Evaluates the location associated with the session IP address.
• Phone risk evaluation: Evaluates phone line type and recent changes to the SIM and subscriber pairing.

Add a risk signal source

1. From the left-hand menu, select Instance configuration > Risk signal sources.
2. Select Add source.
3. Select Geolocation or Phone risk evaluation.
4. Enter a Name and, optionally, a Description.
5. Optionally, select a Policy tag.
6. Enter the variable prefix for the source. The variable prefix determines the namespace used for the source's output variables. It is set when the source is created and cannot be changed later.
7. Configure the source's level mapping.
8. Select Save.

Source outputs

When you add a risk signal source to a risk policy, its outputs are automatically available as read-only local variables.

Output variables use the variable prefix configured for the source:

<variable_prefix>.<variable_name>

Each built-in source provides a normalized level output. The level can be Low, Medium, or High and can be used by risk rules and risk scoring.

Additional outputs depend on the source type.

Geolocation

The Geolocation source evaluates the geographic location associated with the session IP address.

It provides the following outputs:

Configure the level mapping

Use the Level mapping section to assign locations to risk levels.

• Locations assigned to Medium report a Medium level.
• Locations assigned to High report a High level.
• All other locations report a Low level.

You can configure mappings for countries and more specific locations within them.

When more than one configured location matches, the most specific location takes precedence. For example, if a country is configured as High but a city within that country is configured as Medium, sign-ins from that city report Medium.

If multiple matches have the same level of specificity, the highest configured risk level takes precedence.

Phone risk evaluation

The Phone risk evaluation source evaluates information about a phone number.

The phone number itself is supplied when the source is added to a risk policy.

The source provides the following outputs:

Configure the level mapping

The source provides predefined phone-risk conditions. Select the level that the source should report when each condition is detected.

These include:

• line_type = non-fixed VoIP
• line_type = fixed VoIP
• line_type = landline
• sim_pairing_changed = true

Conditions that are not listed in the level mapping report a Low level.

The configured mapping applies everywhere the source instance is used.

Delete a risk signal source

To delete a source, open it and select Delete source under Danger zone.

A source cannot be deleted while a risk policy references it. Remove the source from those policies before deleting it.