[{"data":1,"prerenderedAt":639},["ShallowReactive",2],{"navigation_docs":3,"-concepts-alerts-cases-reporting":183,"-concepts-alerts-cases-reporting-surround":634},[4,25,60,81,153,168],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":6},"Getting started",false,"\u002Fgetting-started","1.getting-started",[10,15,20],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F2.quickstart","i-lucide-zap",{"title":21,"path":22,"stem":23,"icon":24},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F3.installation","i-lucide-server",{"title":26,"icon":6,"path":27,"stem":28,"children":29,"page":6},"Concepts","\u002Fconcepts","2.concepts",[30,35,40,45,50,55],{"title":31,"path":32,"stem":33,"icon":34},"How AML works","\u002Fconcepts\u002Fhow-aml-works","2.concepts\u002F1.how-aml-works","i-lucide-book-open",{"title":36,"path":37,"stem":38,"icon":39},"Events and decisions","\u002Fconcepts\u002Fevents-and-decisions","2.concepts\u002F2.events-and-decisions","i-lucide-activity",{"title":41,"path":42,"stem":43,"icon":44},"Rules","\u002Fconcepts\u002Frules","2.concepts\u002F3.rules","i-lucide-scale",{"title":46,"path":47,"stem":48,"icon":49},"Alerts, cases and reporting","\u002Fconcepts\u002Falerts-cases-reporting","2.concepts\u002F4.alerts-cases-reporting","i-lucide-folder-search",{"title":51,"path":52,"stem":53,"icon":54},"Entities and the graph","\u002Fconcepts\u002Fentities-and-graph","2.concepts\u002F5.entities-and-graph","i-lucide-network",{"title":56,"path":57,"stem":58,"icon":59},"Audit log","\u002Fconcepts\u002Faudit-log","2.concepts\u002F6.audit-log","i-lucide-scroll-text",{"title":61,"icon":6,"path":62,"stem":63,"children":64,"page":6},"Guides","\u002Fguides","3.guides",[65,70,75],{"title":66,"path":67,"stem":68,"icon":69},"Guides by role","\u002Fguides\u002Fby-role","3.guides\u002F1.by-role","i-lucide-users",{"title":71,"path":72,"stem":73,"icon":74},"Integration plan","\u002Fguides\u002Fintegration-plan","3.guides\u002F2.integration-plan","i-lucide-list-checks",{"title":76,"path":77,"stem":78,"icon":79,"badge":80},"Connecting a rail","\u002Fguides\u002Fconnecting-a-rail","3.guides\u002F3.connecting-a-rail","i-lucide-plug","Coming soon",{"title":82,"icon":6,"path":83,"stem":84,"children":85,"page":6},"API reference","\u002Fapi","4.api",[86,91,96,101,106,111,116,121,126,129,134,139,144,149],{"title":87,"path":88,"stem":89,"icon":90},"Authentication","\u002Fapi\u002Fauthentication","4.api\u002F01.authentication","i-lucide-key-round",{"title":92,"path":93,"stem":94,"icon":95},"Errors","\u002Fapi\u002Ferrors","4.api\u002F02.errors","i-lucide-circle-alert",{"title":97,"path":98,"stem":99,"icon":100},"Idempotency","\u002Fapi\u002Fidempotency","4.api\u002F03.idempotency","i-lucide-repeat",{"title":102,"path":103,"stem":104,"icon":105},"Health","\u002Fapi\u002Fhealth","4.api\u002F04.health","i-lucide-heart-pulse",{"title":107,"path":108,"stem":109,"icon":110},"Entities","\u002Fapi\u002Fentities","4.api\u002F05.entities","i-lucide-user-round",{"title":112,"path":113,"stem":114,"icon":115},"Events","\u002Fapi\u002Fevents","4.api\u002F06.events","i-lucide-send",{"title":117,"path":118,"stem":119,"icon":120},"Decisions","\u002Fapi\u002Fdecisions","4.api\u002F07.decisions","i-lucide-gavel",{"title":122,"path":123,"stem":124,"icon":125},"Alerts","\u002Fapi\u002Falerts","4.api\u002F08.alerts","i-lucide-bell",{"title":41,"path":127,"stem":128,"icon":44},"\u002Fapi\u002Frules","4.api\u002F09.rules",{"title":130,"path":131,"stem":132,"icon":133},"Screening","\u002Fapi\u002Fscreening","4.api\u002F10.screening","i-lucide-user-search",{"title":135,"path":136,"stem":137,"icon":138},"API keys","\u002Fapi\u002Fapi-keys","4.api\u002F11.api-keys","i-lucide-key",{"title":140,"path":141,"stem":142,"icon":143},"Overview","\u002Fapi\u002Foverview","4.api\u002F12.overview","i-lucide-layout-dashboard",{"title":145,"path":146,"stem":147,"icon":148,"badge":80},"Webhooks","\u002Fapi\u002Fwebhooks","4.api\u002F13.webhooks","i-lucide-webhook",{"title":80,"path":150,"stem":151,"icon":152,"badge":80},"\u002Fapi\u002Fcoming-soon","4.api\u002F14.coming-soon","i-lucide-clock",{"title":154,"icon":6,"path":155,"stem":156,"children":157,"page":6},"Security and licensing","\u002Fsecurity","5.security",[158,163],{"title":159,"path":160,"stem":161,"icon":162},"Data flows","\u002Fsecurity\u002Fdata-flows","5.security\u002F1.data-flows","i-lucide-shield-check",{"title":164,"path":165,"stem":166,"icon":167,"badge":80},"Licensing and metering","\u002Fsecurity\u002Flicensing","5.security\u002F2.licensing","i-lucide-file-badge",{"title":169,"icon":6,"path":170,"stem":171,"children":172,"page":6},"Reference","\u002Freference","6.reference",[173,178],{"title":174,"path":175,"stem":176,"icon":177},"Glossary","\u002Freference\u002Fglossary","6.reference\u002F1.glossary","i-lucide-book-a",{"title":179,"path":180,"stem":181,"icon":182},"FAQ","\u002Freference\u002Ffaq","6.reference\u002F2.faq","i-lucide-circle-help",{"id":184,"title":46,"body":185,"description":627,"extension":628,"links":629,"meta":630,"navigation":631,"path":47,"seo":632,"stem":48,"__hash__":633},"docs\u002F2.concepts\u002F4.alerts-cases-reporting.md",{"type":186,"value":187,"toc":601},"minimark",[188,192,196,225,247,305,308,312,331,338,360,367,371,422,433,437,441,452,459,462,466,469,560,564,590,596],[189,190,191],"p",{},"Decisions that need a person become alerts, and so do screenings that find a potential match. An analyst works the alert and proposes how to close it, and a second person approves. That part is built. Cases, which group alerts into an investigation, and reports to your FIU are planned and described further down.",[193,194,122],"h2",{"id":195},"alerts",[189,197,198,199,203,204,207,208,203,211,214,215,217,218,220,221,224],{},"A ",[200,201,202],"code",{},"review"," or ",[200,205,206],{},"block"," decision goes on an alert. Alerts are grouped by source: while a customer has an alert that is ",[200,209,210],{},"open",[200,212,213],{},"in_review",", their next ",[200,216,202],{}," and ",[200,219,206],{}," decisions join it instead of raising new ones. The alert counts them in ",[200,222,223],{},"occurrences"," and points at the highest-scoring one. One busy wallet doesn't fill the queue.",[189,226,227,228,231,232,217,234,237,238,240,241,243,244,246],{},"An alert starts at ",[200,229,230],{},"medium"," priority for a ",[200,233,202],{},[200,235,236],{},"high"," for a ",[200,239,206],{},", and a later ",[200,242,206],{}," raises it to ",[200,245,236],{},".",[248,249,250,263],"table",{},[251,252,253],"thead",{},[254,255,256,260],"tr",{},[257,258,259],"th",{},"Status",[257,261,262],{},"Meaning",[264,265,266,276,285,295],"tbody",{},[254,267,268,273],{},[269,270,271],"td",{},[200,272,210],{},[269,274,275],{},"Waiting for an analyst",[254,277,278,282],{},[269,279,280],{},[200,281,213],{},[269,283,284],{},"Assigned and being worked",[254,286,287,292],{},[269,288,289],{},[200,290,291],{},"pending_closure",[269,293,294],{},"An analyst proposed a disposition and it's waiting for a second person",[254,296,297,302],{},[269,298,299],{},[200,300,301],{},"closed",[269,303,304],{},"A second person approved the closure",[189,306,307],{},"Once an alert is pending closure or closed, it takes no more decisions. New activity from that source starts a new alert.",[193,309,311],{"id":310},"alerts-from-screening","Alerts from screening",[189,313,198,314,318,319,322,323,325,326,328,329,246],{},[315,316,317],"a",{"href":131},"screening"," that comes back ",[200,320,321],{},"potential_match"," raises its own alert. It's ",[200,324,236],{}," priority if any match is on a sanctions list, and ",[200,327,230],{}," otherwise. In the queue it shows the best match score and one reason per match, and its event type is ",[200,330,317],{},[189,332,333,334,337],{},"An analyst works it on the ",[335,336,130],"strong",{}," screen, one match at a time:",[339,340,341,348,354],"ul",{},[342,343,344,347],"li",{},[335,345,346],{},"True match."," It's the person on the list. This counts at once, and the alert stays open so someone acts on it.",[342,349,350,353],{},[335,351,352],{},"Need more info."," Can't tell yet. This counts at once, and the match stays open.",[342,355,356,359],{},[335,357,358],{},"False positive."," It's someone else. A second person has to approve this before it counts.",[189,361,362,363,366],{},"When every match is cleared and approved, the alert closes by itself as ",[200,364,365],{},"false_positive",". Nobody has to close it by hand. A screening alert can also be closed the usual way, with a disposition and a second approval.",[193,368,370],{"id":369},"working-an-alert","Working an alert",[372,373,375,380,386,390,393,397,412,416],"steps",{"level":374},"3",[376,377,379],"h3",{"id":378},"triage","Triage",[189,381,382,383,385],{},"An analyst opens the ",[335,384,122],{}," queue in the dashboard, picks an alert, and assigns it to themselves. They see the score, the rules that fired and why, and the event behind it.",[376,387,389],{"id":388},"notes","Notes",[189,391,392],{},"The analyst records what they checked and what they found as notes on the alert. Notes are kept with the author's key and a timestamp.",[376,394,396],{"id":395},"propose-a-disposition","Propose a disposition",[189,398,399,400,402,403,203,406,409,410,246],{},"The analyst asks to close the alert as ",[200,401,365],{},", ",[200,404,405],{},"escalated",[200,407,408],{},"reported",". The alert moves to ",[200,411,291],{},[376,413,415],{"id":414},"second-approval","Second approval",[189,417,418,419,421],{},"A reviewer, signed in with a different API key, approves or rejects. Approving closes the alert. Rejecting sends it back to ",[200,420,213],{},". The analyst who asked can't approve their own closure.",[189,423,424,425,428,429,432],{},"Every status change, assignment, note and closure step is written to the ",[315,426,427],{"href":57},"audit log"," with the key that made it. The ",[315,430,431],{"href":123},"alerts API"," does the same things as the dashboard.",[434,435,436],"note",{},"Four-eyes compares API keys, not people, because Sentinel has no user accounts yet. Give each person their own key so the check means what it should.",[193,438,440],{"id":439},"cases","Cases",[442,443,444,445,448,449,451],"warning",{},"Cases, freezes and reporting are ",[335,446,447],{},"not built yet",". The rest of this page describes the planned design. Today a ",[200,450,408],{}," disposition records the decision to report, but nothing is drafted or filed.",[189,453,454,455,458],{},"A case groups related alerts with the evidence: transactions, linked entities, attachments, notes and a written ",[335,456,457],{},"narrative",". The narrative is a plain account of what happened and why it's suspicious. Sentinel drafts the first version from the evidence and the analyst edits it.",[189,460,461],{},"The analyst proposes an outcome: close, keep monitoring, or report. A reviewer must approve it. The analyst can't close a case alone. Once closed, a case is read-only.",[193,463,465],{"id":464},"a-case-end-to-end","A case, end to end",[189,467,468],{},"Here is how one suspicious transfer will be followed through the console once cases and reporting exist.",[372,470,471,474,479,483,497,501,504,508,511,515,518,521,531,535,538,542,549,553],{"level":374},[376,472,379],{"id":473},"triage-1",[189,475,382,476,478],{},[335,477,122],{}," queue. A high-priority alert sits near the top, with its score, the rules that fired and a summary.",[376,480,482],{"id":481},"look-wider","Look wider",[189,484,485,486,488,489,492,493,496],{},"On the ",[335,487,107],{}," screen, the ",[335,490,491],{},"Network graph"," shows the wallet linked to 23 senders (most of them first-time), a wallet opened three days ago on the same phone, a cash-out agent where 9,800 was withdrawn, and another alert about that same agent. It looks like a ",[335,494,495],{},"mule network",": victims' money collected in one wallet, passed on and cashed out fast.",[376,498,500],{"id":499},"freeze","Freeze",[189,502,503],{},"To stop more money leaving, the analyst freezes the wallet. Sentinel tells the operator to block outgoing transfers and cash-outs. Incoming money still arrives so the trail stays visible. The customer sees a generic error, and the reason goes into the audit log.",[376,505,507],{"id":506},"open-a-case","Open a case",[189,509,510],{},"The analyst groups the two alerts into a case, attaches the 61 transactions and a letter from the operator's fraud desk, and edits the narrative.",[376,512,514],{"id":513},"propose-an-outcome","Propose an outcome",[189,516,517],{},"The analyst proposes \"close as reported\" and sends the case for review.",[376,519,415],{"id":520},"second-approval-1",[189,522,485,523,526,527,530],{},[335,524,525],{},"Four-eyes review"," screen, a reviewer sees the proposal, what will happen if they approve, and exactly what changed since they last looked. They tick four checks: the narrative supports suspicion, details match KYC, attachments are readable, and there's no conflict of interest. Then they confirm in the ",[335,528,529],{},"Approve and file"," dialog.",[376,532,534],{"id":533},"file","File",[189,536,537],{},"Sentinel validates the STR against goAML's rules and submits it to your FIU. When the FIU's receipt comes back, it's stored on the case. The case closes and becomes read-only, and a PDF copy of the filed report is kept.",[376,539,541],{"id":540},"fix-a-rejection","Fix a rejection",[189,543,544,545,548],{},"Sometimes goAML bounces a report, for example for a missing date of birth. The ",[335,546,547],{},"Filing rejected"," screen shows which field failed, links to where to fix it, and shows the deadline. The analyst fixes it and resubmits.",[376,550,552],{"id":551},"prove-it-later","Prove it later",[189,554,555,556,559],{},"At the end of the quarter, the compliance lead builds an ",[335,557,558],{},"evidence pack",". Every action above is in the audit log.",[193,561,563],{"id":562},"reporting","Reporting",[339,565,566,572,578,584],{},[342,567,568,571],{},[335,569,570],{},"STRs"," are drafted from a case, validated against goAML's schema and rules before submission, and filed with your FIU. The FIU's receipt is stored on the case.",[342,573,574,577],{},[335,575,576],{},"CTRs"," are generated in batches from monitored cash events above the threshold you configure.",[342,579,580,583],{},[335,581,582],{},"Rejections"," come back with the exact fields that failed. New checks are added to the validator so the same mistake fails locally next time.",[342,585,586,589],{},[335,587,588],{},"Evidence packs"," combine policies, the rule inventory, alert statistics, case outcomes and filings into one signed PDF for regulators and partners.",[442,591,592,595],{},[335,593,594],{},"Tipping off."," Sentinel never exposes why an account was blocked or frozen through anything a customer can see. Your customer-facing systems should show a generic error. Telling a customer they've been reported is an offence in most jurisdictions.",[434,597,598,599,246],{},"The cases and reports APIs are not available yet. See ",[315,600,80],{"href":150},{"title":602,"searchDepth":603,"depth":603,"links":604},"",2,[605,606,607,614,615,626],{"id":195,"depth":603,"text":122},{"id":310,"depth":603,"text":311},{"id":369,"depth":603,"text":370,"children":608},[609,611,612,613],{"id":378,"depth":610,"text":379},3,{"id":388,"depth":610,"text":389},{"id":395,"depth":610,"text":396},{"id":414,"depth":610,"text":415},{"id":439,"depth":603,"text":440},{"id":464,"depth":603,"text":465,"children":616},[617,618,619,620,621,622,623,624,625],{"id":473,"depth":610,"text":379},{"id":481,"depth":610,"text":482},{"id":499,"depth":610,"text":500},{"id":506,"depth":610,"text":507},{"id":513,"depth":610,"text":514},{"id":520,"depth":610,"text":415},{"id":533,"depth":610,"text":534},{"id":540,"depth":610,"text":541},{"id":551,"depth":610,"text":552},{"id":562,"depth":603,"text":563},"From a decision to a report filed with your FIU.","md",null,{},{"icon":49},{"title":46,"description":627},"IlyO3NAhRsnZ5gqNRkN70p8o1AICbwp7p-FD5IB5usE",[635,637],{"title":41,"path":42,"stem":43,"description":636,"icon":44,"children":-1},"How rules are written, how they add up to a score, and how to change one safely.",{"title":51,"path":52,"stem":53,"description":638,"icon":54,"children":-1},"The people, accounts, devices and agents Sentinel keeps profiles for, and how they connect.",1792169658428]