Real-Time Alert Queue
Isolation Forest scores stream from Kafka. Officers review only high-confidence anomalies.
Open alerts
612
FP rate
4.8%
Median review
38s
| Alert ID | Customer | Risk | Status |
|---|---|---|---|
| AL-88421 | Card · travel cluster | 0.91 | Queued |
| AL-88419 | ACH · velocity spike | 0.97 | Escalated |
| AL-88402 | Wire · geo mismatch | 0.42 | Auto-cleared |
| North quay cutover | Open | Open | Open |
| East yard sweep | Running | Running | Running |
| Night batch 14 | On Track | On Track | On Track |
| Canary 10% | At Risk | At Risk | At Risk |
| Blue-green 2.4 | Queued | Queued | Queued |
| Freeze window | Resolved | Resolved | Resolved |
| Pager rewrite | Escalated | Escalated | Escalated |
| Token ceiling | Pending | Pending | Pending |
| Shadow path | Open | Open | Open |
| Guild review | Running | Running | Running |
| License reclaim | On Track | On Track | On Track |
| Merge train | At Risk | At Risk | At Risk |
| Eval nightly | Queued | Queued | Queued |
| Prompt budget | Resolved | Resolved | Resolved |
| Board brief | Escalated | Escalated | Escalated |
| SLA watch | Pending | Pending | Pending |
| Deny list | Open | Open | Open |
Live Transaction Monitor
Core ledger webhooks scored in under 45ms. Batch lag eliminated.
Kafka ingest45ms p992.1M accounts
| Txn | Amount | Score | Decision |
|---|---|---|---|
| POS-99201 | $127.44 | 0.12 | Approve |
| ACH-44102 | $8,400 | 0.88 | Hold |
| WIRE-2209 | $52,000 | 0.96 | Block |
| North quay cutover | Open | 68% | Open |
| East yard sweep | Running | 73% | Running |
| Night batch 14 | On Track | 78% | On Track |
| Canary 10% | At Risk | 83% | At Risk |
| Blue-green 2.4 | Queued | 88% | Queued |
| Freeze window | Resolved | 93% | Resolved |
| Pager rewrite | Escalated | 69% | Escalated |
| Token ceiling | Pending | 74% | Pending |
| Shadow path | Open | 79% | Open |
| Guild review | Running | 84% | Running |
| License reclaim | On Track | 89% | On Track |
| Merge train | At Risk | 94% | At Risk |
| Eval nightly | Queued | 70% | Queued |
| Prompt budget | Resolved | 75% | Resolved |
| Board brief | Escalated | 80% | Escalated |
| SLA watch | Pending | 85% | Pending |
| Deny list | Open | 90% | Open |
Anomaly Model Registry
Isolation Forest AUC
0.94
Daily scored
3.2M
Drift alerts
0
Card spend v3
Production · 14d champion
ACH velocity
Shadow · canary 8%
Investigation Workbench
CASE-2201
Synthetic mule pattern · 4 linked accounts
CASE-2198
Travel false positive cleared
- Merged device graph for CASE-2201
- Officer approved unlock for AL-88390
- SAR draft queued for compliance
Legacy Rules Overlay
Deterministic guardrails sit above ML — hard blocks for sanctions and velocity caps.
| Rule | Hits today | Override |
|---|---|---|
| Sanctions OFAC | 3 | Never |
| >$25K wire | 41 | Officer |
| Cross-border 2h | 128 | ML score |
| North quay cutover | Open | Open |
| East yard sweep | Running | Running |
| Night batch 14 | On Track | On Track |
| Canary 10% | At Risk | At Risk |
| Blue-green 2.4 | Queued | Queued |
| Freeze window | Resolved | Resolved |
| Pager rewrite | Escalated | Escalated |
| Token ceiling | Pending | Pending |
| Shadow path | Open | Open |
| Guild review | Running | Running |
| License reclaim | On Track | On Track |
| Merge train | At Risk | At Risk |
| Eval nightly | Queued | Queued |
| Prompt budget | Resolved | Resolved |
| Board brief | Escalated | Escalated |
| SLA watch | Pending | Pending |
| Deny list | Open | Open |
AML & Regulatory Reports
SAR drafts
7
Audit overhead
-88%
Officer FTE
6
Compliance Agent Activity
- Summarized 14-txn thread for officer review
- Auto-cleared travel cluster AL-88312
- Drafted SAR narrative for CASE-2201
- Synced disposition to core ledger API
Data & Core Systems
Core ledger APIDevice graph DBKafkaPython scoring
Ledger webhooks
Healthy · 12ms avg
Case management
Bi-directional sync
Workspace
Region: US-East · Model: Isolation Forest ensemble · Retention: 7y audit
Fraud Shield Console journal
Session log for this simulated fraud desk. Not a live production feed.
| Event | Actor | When | Status | Score |
|---|---|---|---|---|
| Fraud weekday CSV open | Ops | 07:02 | On Track | 92% |
| Fraud desk record add | Ops | 07:14 | Running | 88% |
| Fraud P1 watch fire | Reviewer | 07:21 | Escalated | 41% |
| Fraud exception approve | Reviewer | 08:05 | Resolved | 95% |
| Fraud 07:00 schedule set | Sponsor | 08:12 | Queued | 74% |
| Fraud filter At Risk | Ops | 08:40 | On Track | 81% |
| Fraud row View open | Ops | 09:01 | Running | 86% |
| Fraud row Edit save | Reviewer | 09:18 | On Track | 90% |
| Fraud row Delete confirm | Reviewer | 09:33 | Resolved | 93% |
| Fraud role switch | Sponsor | 10:02 | Queued | 77% |
| Fraud mobile nav jump | Ops | 10:15 | On Track | 84% |
| Fraud seed pad to 20 | Ops | 10:22 | Running | 89% |
| Fraud schedule weekday | Sponsor | 11:00 | Pending | 68% |
| Fraud CSV download | Ops | 11:08 | On Track | 91% |
| Fraud idle reclaim | Reviewer | 12:01 | Open | 62% |
| Fraud token ceiling | Sponsor | 12:40 | At Risk | 49% |
| Fraud deny-list drift | Reviewer | 13:05 | At Risk | 53% |
| Fraud gold-path flake | Ops | 13:44 | Escalated | 47% |
| Fraud board pack draft | Sponsor | 14:10 | Queued | 71% |
| Fraud session keep-alive | Ops | 14:55 | On Track | 97% |
- Fraud Shield Console: opened weekday CSV for the live filter
- Fraud Shield Console: added a desk record from the rail
- Fraud Shield Console: P1 watch fired and stayed in session
- Fraud Shield Console: reviewer approved one exception
- Fraud Shield Console: scheduled 07:00 delivery on this device
Fraud Shield Console scorecards
Ten-plus working reports for this desk. Export carries the active filter.
| Report | Owner | Cadence | Status | Score |
|---|---|---|---|---|
| Fraud open queue | Ops | Weekdays 07:00 | Live | 91% |
| Fraud at-risk rollup | Reviewer | Fridays 16:00 | Live | 84% |
| Fraud executive brief | Sponsor | Monday 08:30 | Queued | 72% |
| Fraud exception log | Reviewer | Daily 18:00 | Live | 88% |
| Fraud capacity watch | Ops | Hourly | Running | 79% |
| Fraud board pack | Sponsor | First Monday | Pending | 61% |
| Fraud SLA burn | Ops | Weekdays 16:00 | On Track | 86% |
| Fraud audit extract | Reviewer | Month end | Queued | 70% |
| Fraud idle reclaim | Ops | Wednesdays | Open | 64% |
| Fraud token spend | Sponsor | Fridays 09:00 | Live | 81% |
| Fraud deny-list drift | Reviewer | Daily 06:00 | At Risk | 52% |
| Fraud gold-path CI | Ops | On merge | Running | 77% |
| Fraud skill coverage | Sponsor | Biweekly | Open | 66% |
| Fraud pager rewrite | Ops | Thursdays | Queued | 58% |
| Fraud license waste | Reviewer | Month start | Resolved | 93% |
| Fraud canary 10% | Ops | On deploy | On Track | 85% |
| Fraud incident drill | Ops | Monthly | Queued | 69% |
| Fraud shadow IT sweep | Reviewer | Monthly | At Risk | 48% |
| Fraud pairing rota | Sponsor | Weekly | Live | 82% |
| Fraud capacity bid | Ops | Monthly | Pending | 59% |