Detection rule review

Step by step

1. Register rule Rule Steward

   The Rule Steward records a rule name, version and expression in draft. The text should identify the suspicious condition the team wants to examine.

   • Captures draft name, version and expression
   • Updates Detection rules

2. Review definition Rule Steward

   The steward and a second reviewer examine the expression against representative applications before the rule is marked reviewed. They should agree which cases would call for attention.

   • Checks rule meaning against case context
   • Updates Detection rules, Applications

3. Mark active Rule Steward

   The steward records the active status only after the reviewed version is understood and its case owner is clear. A later alert carries a link to the relevant rule record.

   • Makes the reviewed rule identifiable to alert reviewers
   • Updates Detection rules, Fraud alerts

4. Retire version Rule Steward

   When the criteria change, the old rule can be retired while prior alerts continue to point to a readable version. Create a new version for the replacement definition.

   • Preserves the rule context of earlier alerts
   • Updates Detection rules, Fraud alerts

Rule Steward

Maintains the register; Fraud Investigator reviews alerts against the rule; Case Analyst supplies application context; Admin manages access.