One more inquiry on this module. Is it possible to have the module ignore prefixes being set in the fraud rules? For our scenarios, the FROM Address/user is the same for most of our calls. On our PBX's we do not really give out DID's to each of our users, so when a user makes an outbound call, the FROM address is always going to be same and set to the main number of our system. Within the fraud detection module, I have a prefix of 99 defined (how we denote an outbound call) and starting getting tons of false positive notifications, as the pair being matched would be <800number, 99numberDialed>. This quickly filled up the sequential calls threshold as every call being made had the same FROM Address and matched against the 99 prefix.
The way we operate, I created 30 minute intervals Sun-Sat with the same threshold values (48 rows of rules). I am hoping I can omit the prefix matching and just match the dialed number to the appropriate 30 minute time interval? so the pair being matched would be <800 number, full number dialed> ? I tried setting a blank prefix and say "No rule matched" syslog message. On Mon, Jan 7, 2019 at 5:48 PM Jonathan Mabrito <[email protected]> wrote: > Hi All, > > I am running OpenSIPS 2.3 and I have a inquiry on the Fraud Detection > module. I had a critical alert get triggered on the call duration threshold > today. No warning came in, just straight to the critical....and way over > the critical duration threshold. > > Looking in the logs, it looks like the critical notification was triggered > when the call disconnected/hung up. Guessing the module accounts the start > and end time of the call and uses that duration? Does it not keep track of > the call from a duration perspective as its happening? > > Luckily this was just one occurrence but it got me thinking, if fraud was > being performed on the system, then the duration notification wont be > triggered until the call is hung up...at least the way I have it > configured. Is there a way to have it keep auditing ongoing calls? > -- > -Jonathan > -- -Jonathan
_______________________________________________ Users mailing list [email protected] http://lists.opensips.org/cgi-bin/mailman/listinfo/users
