> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Add Risk Factors Risk factors are either connected to the **Access Evaluation** node or the **Start** node if no Access Filters have been added to the graph. Risk factors are then connected to the **Risk Evaluation** node. The following figures provide examples. ## Risk Factor connections in the graph ### Risk factors with Access Filter connections ![](/assets/images/risk-factors-access-filters-e7edfa3aac4dbc58695acb186772995a.png) ### Risk Factors with no Access Filters connections ![](/assets/images/risk-factors-no-access-filters-17fcee20c4466d93f5eacd29a430e6ba.png) ## Risk Factors Risk factors are optional policy signals that contribute to the resource rule risk evaluation. For an overview of what each risk factor detects and when to use it, see [Create and manage resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md#risk-factors-and-risk-evaluation). The following risk options are available: | Risk Factor | Description | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [Date/Time](#configure-datetime-risk-factor) | Sets restrictions for authentication attempts within specific dates and times. | | [Device Verification](#device-verification-risk-factor) | Checks that the authenticating device contains a device certificate issued by a Trusted CA configured in IDaaS. | | [External](#configure-external-risk-factor) | Adds External Risk Engines as a risk factor to the resource rule. You must have a risk engine configured to use this feature. See [Manage external risk engines](/docs/authentication-and-security/manage-external-risk-engines.md). | | [Geolocation](#configure-geolocation-risk-factor) | Allows or denies authentication from a list of countries. | | [Source IP Address](#configure-source-ip-address-risk-factor) | Allows or denies authentication from a list of IP addresses. | | [Location History](#location-history-risk-factor) | Checks that the IP address in the request matches a location that was used for a previous authentication request. No further configuration is required for this setting. | | [Machine Authentication](#configure-machine-authentication-risk-factor) | Checks for the fingerprint mismatch risk limit. | | [Transaction](#configure-transaction-risk-factor) | Evaluates risk from transaction details supplied with the authentication request. | | [Travel Velocity](#travel-velocity) | Checks that the travel speed (KMH) is above the value defined in the **Check Travel Velocity** setting of risk-based authenticators. | ### Configure date/time risk factor Complete the following, as required: 1. Click the **Time/WeekDay** tab to set the time, date, and day restrictions, as follows: 1. Click **Allow** or **Deny** to allow or deny a user access based on the Date and Time settings. 2. Select the **Time Zone** from the drop-down list. 3. Set the **Start Time**. You can enter it manually or click the icon and set it with the clock. 4. Optional. Set the **End Time**. You can enter it manually or click the icon and set it with the clock. 5. Click the specific **Weekdays** that are restricted by the Date/Time settings. 2. Click the **Date Range** tab, to set Date Range decision. 1. Click **Allow** or **Deny** to allow or deny a user access based on the Date Range settings. 2. Select the **Time Zone** from the drop-down list. 3. Set the **Start Date**. You can enter it manually or click the icon and set it with the calendar. 4. Optional. Set the **End Date**. You can enter it manually or click the icon and set it with the calendar 5. Click **Save**. ### Device verification risk factor Device verification requires no additional configuration. However, before you use this risk factor, configure the trusted certificate authority that issued the device certificates. See [Configure a Trusted CA](/docs/authentication-and-security/manage-certificate-authorities/configure-a-trusted-ca.md). For information about Entrust PKI products that can support certificate issuance and management, see [Entrust PKI](https://www.entrust.com/products/pki). ### Configure external risk factor Complete the following, as required: 1. Select the **External Risk Engine** from the drop-down list. 2. Click **Add** to add **Rules**. 3. Select the **Rule** from the list. 4. Repeat this step to add more rules. 5. Set a **Risk Limit**. - The risk limit value must be less than the maximum risk score. - External risk engine risk points apply if the accumulated risk score of the failed rules exceeds the risk limit. 6. Click **Save**. #### Example: Apply risk when riskLevel is above 70 You can use the following example when your external connector returns a numeric `riskLevel` from `0` to `100`. For the connector configuration that creates the `riskLevel` result item and `high-ip-risk` rule, see [Configure Connector-based risk engines](/docs/authentication-and-security/manage-external-risk-engines/configure-connector-based-risk-engines.md#example-illustrative-configure-an-ip-based-connector-risk-engine). These are the configuration steps for this example: 1. In the external risk engine configuration, create a rule with the following values: - **Name**: `high-ip-risk` - **Risk Item**: `riskLevel` - **Operator**: `GREATER_THAN` - **Value**: `70` 2. In the resource rule **External** risk factor, select the `high-ip-risk` rule. 3. Set the **Risk Limit** to `70` so only values above `70` apply external risk points. 4. In **Risk Evaluation**, configure the medium-risk and high-risk branches to apply the required outcome (for example, step-up authentication or deny access). See [Add Risk Evaluation](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules/add-a-resource-rule/add-risk-evaluation.md). ### Configure geolocation risk factor Complete the following, as required: 1. Select **Allow** or **Deny** to create an allowed or denied country list. 2. From the **Build countries** drop-down list, select the country to add to the allowed or denied list. 3. Repeat this step to add more countries to the list. 4. Click **Save**. ### Configure source IP address risk factor To use this feature: - To use an **IP List**, you must configure an IP List. See [Manage IP Lists](/docs/authentication-and-security/manage-ip-lists.md). - Add **Custom** IP addresses or IP Ranges. Complete the following, as required: 1. To add allow or deny access to an IP List: 1. Click **IP List**. 2. Select **Allow** or **Deny** to allow or deny access to an IP List. 3. From the **IP List** drop-down list, select the IP address to add to the allowed or denied list. 4. Repeat this step to add more IP Lists. 2. To add a Custom IP address: 1. Click **Custom**. In the IP Range field, type the IP address or the CIDR (custom IP range). This feature supports `IPv4`, `IPv6`, and `CIDR` addresses. 2. Press **Enter** to add the IP address or the CIDR. 3. Repeat these steps to add more custom IP addresses or CIDRs. 3. Click **Save**. ### Location history risk factor No further configuration is required for this setting. The Location History is determined by the settings configured for risk-based authentication. See [Modify risk-based authenticator settings](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings/modify-risk-based-authenticator-settings.md). ### Configure machine authentication risk factor With machine authentication risk factor, the risk score is based on the attribute differences between a user's Machine Authentication information and that recorded on Identity as a Service before the condition fails. If an attribute does not match, the attribute incurs the number of risk points shown in the **Fingerprint Mismatch Risk Limit**. The **Fingerprint Mismatch Risk Limit** values of each non-matching attribute are added together, resulting in a total risk score. This score is normalized to be out of 100 as follows: `Total Risk Score = (Total Risk Points of Failing Attributes / Maximum Risk Points of All Enabled Attributes) * 100` The resource rule condition fails when the number of non-matching risk points exceeds the Machine Authentication Risk value defined in this step. A value of `0` means that a single attribute difference causes the **Device Fingerprint** condition to fail. The default value is `3`. The value between `0-50` can be entered. The default value is defined by the **Machine Risk Limit**. To use this feature, both machine nonce and device fingerprint must be enabled. See [Manage machine authenticator settings](/docs/authentication-and-security/manage-authenticators/manage-machine-authenticator-settings.md). #### Set the fingerprint mismatch risk limit Complete the following, as required: 1. Drag the rule to set the **Fingerprint Mismatch Risk Limit** to the maximum total number of non-matching risk points allowed before a machine authentication attempt fails. Each mismatch adds 10 risk points by default. 2. Click **Save**. ### Configure transaction risk factor Resource rules can support up to two transaction contexts as part of their evaluations for IDaaS Authentication APIs and OIDC and OAuth applications. Transaction contexts work as follows: - Resource rules can support up to two transaction contexts as part of their evaluations for IDaaS Authentication API applications. - A transaction context is associated with one or more transaction rules with a risk score. As transaction rules are evaluated, if the accumulated risk score of the failed transaction rule is greater than a defined risk limit value for the transaction context, risk is assumed and the transaction context risk points are added to the overall risk point total. - A transaction rule is defined as a transaction rule expression. - A transaction rule expression is a boolean expression, using AND and OR operators, where the operands of the expression can be additional transaction rule expressions or transaction item expressions. - A transaction item expression is a simple, single expression of a transaction item and its expected value (for example, Account = "S053541", Amount > "10000", Action = "DEPOSIT", Channel = "ATM"). - A transaction item is a transaction detail name, that is passed in transaction details during authentication, along with its type (STRING or NUMERIC), whether it must be present if a transaction rule uses it, and its default value if it is does not need to be present and is not passed as part of the transaction details during authentication. - To set transactions contexts, see [Manage transactions](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings/manage-transactions.md). You need to do this first before you add Transactions to the resource rule. #### How to configure transaction risk factor Complete the following to configure the transaction risk factor. 1. Click the **Risk Condition** tab, and configure the following: 1. Enter a **Name** for the transaction. 2. Click **Add** to add a transactions rule. See [Manage transactions](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings/manage-transactions.md). 3. Click **Add** again to add more rules. 4. Enter the **Risk Limit** to the maximum transaction risk points allowed before a transaction attempt fails. Transaction risk points apply if the accumulated risk score of the failed transaction exceeds the risk limit. 5. Click **Save**. 2. Click the **Manage Transactions** tab to add or edit Transaction Rules, as follows: **To add a rule** 1. Under **Transactions Rules**, click **Add**. The **Add Transaction Rule** dialog box appears. 2. Enter a **Name** for the transaction rule. 3. Select the **AND** or **OR** operator for each added group expression. 4. Select the **Transaction Item** to which the rule applies from the drop-down list. 5. Select the **Operator** from the drop-down list. 6. Add a value in the **Value** text box. **To add another set of rules to the Transaction Rule** 1. Click **Add Group**. 2. Select the **AND** or **OR** operator for each added group expression. 3. Select the Transaction Item, Operator, and add a Value. 4. Click **Submit** when done. 3. Click **Save**. **To test a rule** 1. Click List Check icon to test the Transaction Rule. The **Test Rule** dialog box appears. 2. Click **Test Rule**. 3. Click **Close** to close the dialog box. ### Travel velocity No further configuration is required for this setting. This risk factor uses the setting defined in the **Check Travel Velocity** setting of risk-based authenticators to check that the travel speed (KMH) is above the value. See [Modify risk-based authenticator settings](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings.md).