This SAS KB article describes which SAS® Fraud Management application areas to check if SAS Enterprise Case Management (ECM) does not create an event.
Table of Contents
Analyze SAS Enterprise Case Management
SAS Enterprise Case Management integration is an event-based mechanism that pushes alerts from SAS Fraud Management to an external case management system.
To set up case management events, complete the following steps:
- Log on to the SAS Fraud Management user interface (UI).
- Navigate to the Preferences tab ► Call Results ► select Case Management Events. The Case Management Event Configuration page is displayed.
- Select the actions that you want to add to the SAS Enterprise Case Management message content against each Call Result. (For example, Send ECM, Add Action, and Add Transaction.)
Access and Permissions
SAS Enterprise Case Management messages are system-generated messages, not analyst actions. As a result, system IDs should have appropriate permissions. The system user ID is stored in the webapp.systemUser property, and the default is fmsysuser.
The system user should have the following configuration. You can check the configuration by navigating to the SAS Fraud Management user interface (UI) ► the Users tab ► select fmsysuser.
- roles: analyst
- multi-organizations: select all multi-organizations
- alert access: select all alert types
System Grid Template
You can select transaction data by navigating to the SAS Fraud Management UI ► the Preferences tab ► System Grid Templates ► Case Management. Then, you can select the transaction type and restrict the number of days to retrieve current transactions in the Days of recent transactions to be retrieved box.
All transactions that are extracted and sent to the external case management system use this single case management grid configuration.
To make this change effective, click Save ► Deploy Grids.
Note that you are not required to restart the SAS Fraud Management WebApp server for the grid changes to be effective.
With the above settings, the SAS Enterprise Case Management payload successfully generates. You can validate whether the payload was generated by querying the System of Record (SOR) table below:
SELECT * from FCM_ALERT_ECM where ALERT_ID = ‘<ALERT that analyst worked on>’;
Configuration Changes for the SAS Fraud Management Middle-Tier Application
After the SAS Fraud Management middle-tier generates a SAS Enterprise Case Management payload successfully, you need a middleware messaging queue (IBM, MQ, or Apache ActiveMQ) for the external system to pick up the SAS Enterprise Case Management payload.
To ensure that the MQ connection is set up correctly, verify the connection by doing the following:
- Log on to the SAS Fraud Management WebApplication host with the installation user: cd !SASConfig/Lev1/Web/WebAppServer/SASServerX_Y/conf/Catalina/localhost.
- Review the SASFraudMgmtMid-Tier<impl-name>.xml file and update the bolded areas with the appropriate MQ server details.
- If you make any changes in the XML file, restart SASServerX_Y to make the changes effective.
<Resource
name="sascf_jmsfactory"
auth="Application"
type="com.ibm.mq.jms.MQConnectionFactory"
description="JMS Connection Factory"
factory="org.apache.naming.factory.BeanFactory"
queueManager="<Queue manager name>"
port="<listening port>"
hostName="<MQ host name where activeMQ or IBM mq running>"
channel="<Channel name>"
transportType="1"
/>
<Resource
name="sascf_ecmisend"
auth="Application"
type="com.ibm.mq.jms.MQQueue"
description="ECM Integration Send Queue"
factory="org.apache.naming.factory.BeanFactory"
baseQueueName="ECMI_SEND"
targetClient="1"
/>
After completing these steps, the SAS Enterprise Case Management message should flow from SAS Fraud Management to a messaging queue, and the external system will consume it.
XML Message Layout
The XML message layout describes the alert, alert action, and its transactions. The demographic, contact, verification, and transaction tags are configuration-driven and differ for client implementation.
Here is an example of a check-in message from a confirmed fraud call result. The message includes some local demographics that are associated with the alert, as well as one transaction that was identified as a confirmed fraud. This message is also the transaction that created the alert.
<ecmi xmlns="urn:SASFraudManagement:ECMI_1_3">
<username>User1</username>
<siteID>SAS FM SOR ID</siteID>
<event>CHECKIN.CONFIRMEDFRAUD</event>
<alerts>
<alert>
<id>565973</id>
<version>226</version>
<type>C</type>
<createTimestamp>2015-10-21T19:48:22</createTimestamp>
<entityID>000_651044890658</entityID>
<parentEntityID>000_44496651</parentEntityID>
<parentEntityType>A</parentEntityType>
<contactID>000_13651044890658</contactID>
<contactType>X</contactType>
<multiOrg>BANK1</multiOrg>
<stategyName/>
<queueID>61713</queueID>
<queueName/>
<ruleID>46318</ruleID>
<ruleVersion>1</ruleVersion>
<ruleName/>
<alertReason/>
<lastCallResult>CONFIRMED FRAUD</lastCallResult>
<fraudType>TK</fraudType>
<systemBlock>YCARD</systemBlock>
<transactionBlock>4</transactionBlock>
<groupCode>TK</groupCode>
<contact>
<item name="addressLine1">123 MAIN ST</item>
<item name="city">KILSYTH</item>
<item name="country">AU</item>
<item name="countryCode">036</item>
<item name="email">MARCEL@EMAIL.CO<M item>
<item name="fullName">DUPREE,MARCEL</item>
<item name="homePhone1">(02) 9206 1134</item>
<item name="languageCode">EN</item>
<item name="mobilePhone1">(08) 9362 7786</item>
<item name="postalCode">6058</item>
<item name="stateProvinceName">SA</item>
<item name="workPhone1">(02) 9633 3368</item>
<item name="gmtOffset">10.0</item>
</contact>
<verification>
<item name="fullName">DUPREE,MARCEL</item>
<item name="email">MARCEL@EMAIL.CO<M item>
</verification>
<transactions>
<transaction>
<field name="timestamp">2006-09-09T15:27:06</field>
<field name="type">CCCA</field>
<field name="id">475731</field>
<field name="createdAlert">1</field>
<field name="tcaMerchAmt">1500.0</field>
<field name="tcaClientAmt">3409.29</field>
<field name="tcaMerchCurrCode">356</field>
<field name="rrrScore1">81</field>
<field name="hctMerMCC">6011</field>
<field name="hctTermOwnerName"/>
<field name="hctTermCity"/>
<field name="hctTermState"/>
<field name="hctTermPostCode"/>
<field name="hctTermOwnerId"/>
<field name="hctTermCntryCode">356</field>
<field name="tcaCashBackAmt"/>
<field name="hctMedia"/>
<field name="rrrActionCode">1</field>
<field name="ucmCustPresent"/>
</transaction>
</transactions>
</alert>
</alerts>
</ecmi>
If the SAS Enterprise Case Management payload still fails after implementing these settings, check the following logs for error messages:
- SASFraudMgmtMidTier<impl-name>.log
- server.log
- catalina.out
- activemq.log or IBM MQ log from the MQ host.
If you are unable to find or resolve the error, open a case with the SAS Real Time Solutions Technical Support team by sending an email to frdmgmtsupport@sas.com.