When are Suspicious Activity alerts produced?
An alert is produced when detected activity meets the escalation settings for its alert type.
Overview
Kinectify detects potentially suspicious activity using the detection criteria for each alert type. Many alert types look at transaction patterns, and some look at player attributes such as risk score level, so the criteria vary by alert type.
Each detected event is given a Confidence Score and checked against the escalation criteria. Only events that meet them become alerts. Events that do not are recorded in the Non-Escalated Events log, where they remain searchable and auditable.
Alerts are processed according to a customizable schedule, which each client can modify as needed by contacting your account manager. If you require more information about alert scheduling, reach out to your account manager.
Pattern qualification and Deep Analysis
If pattern qualification is turned on for your property, an alert is produced only after the required number of qualifying events occurs within the evaluation period.
If Deep Analysis is turned on, Kinectify also considers past investigation outcomes at your property when deciding whether to produce an alert. If it is off, the event's Confidence Score is compared with the escalation threshold.
Alert criteria
Each alert type's criteria are set in Settings → Property → Alerts (Beta), where each alert type has four tabs:
Detection criteria: what activity is detected. This includes the Detection window, the timeframe Kinectify examines each time it runs (for example, with a 30-day detection window, Kinectify analyzes the previous 30 days of transactions), and the alert type's detection thresholds, such as a volume threshold that produces an event when the total of all transactions in the detection window exceeds the threshold amount.
Risk assessment: the primary, contributing and mitigating risk factors that produce the event's Confidence Score. Contributing factors increase the score and mitigating factors reduce it.
Escalation qualification: the Escalation threshold, the minimum Confidence Score an event needs to become an alert, plus the pattern qualification settings. Events below the threshold become non-escalated events.
Escalation prioritization: the High priority threshold. Alerts at or above it are marked High Priority.