PingOne Platform APIs

Create Risk Predictor (Composite with country and user group)

 

POST {{apiPath}}/environments/{{envID}}/riskPredictors

This request creates a composite predictor that includes a condition that takes into account what user groups the user belongs to.

The compositions array contains a number of condition sets.

The first set of conditions specify that the composite predictor should be assigned a risk level of High if any of the following conditions are met:

  • The anonymousNetwork predictor is determined to be high risk.

  • Any three predictors in the policy being evaluated are found to be high risk.

  • The user is requesting access from a country other than Italy or Germany.

If none of the above conditions are met, the second object in the compositions array specifies that if the userLocationAnomaly predictor is determined to be high risk, and the user is not a member of the networkAdmins group, then the composite predictor should be assigned a risk level of Medium.

If the second set of conditions is also not met, the composite predictor should be assigned a risk level of Low (default.result.level).

Prerequisites

Request Model

Refer to Risk Predictors for the complete data models.

Base data model

Property Type Required?

compactName

String

Required

default

Object

Required

default.weight

Integer

Required

default.result

Object

Required

default.result.level

String

Required

description

String

Optional

licensed

Boolean

Required

name

String

Required

reason

String

Required

type

String

Required

whiteList

List[]

Optional

Composite data model

Property Type Required?

compositions

Array

Required

compositions[].condition

Object

Required

compositions[].level

String

Required

Headers

Authorization      Bearer {{accessToken}}

Content-Type      application/json

Body

raw ( application/json )

{
    "name": "Composite - including country and user groups",
    "compactName": "compositeWithCountryAndUserGroups",
    "licensed": true,
    "compositions": [
        {
            "condition": {
                "or": [
                    {
                        "equals": 3,
                        "value": "${details.counters.predictorLevels.high}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "equals": "HIGH",
                        "value": "${details.anonymousNetwork.level}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "type": "STRING_LIST",
                        "list": [
                            "Italy",
                            "Germany"
                        ],
                        "notContains": "${details.country}"
                    }
                ]
            },
            "level": "HIGH"
        },
        {
            "condition": {
                "and": [
                    {
                        "equals": "HIGH",
                        "value": "${details.userLocationAnomaly.level}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "list":["networkAdmins"],
                        "notContains":"${event.user.groups}",
                        "type":"GROUPS_INTERSECTION"
                    }
                ]
            },
            "level": "MEDIUM"
        }
    ],
    "type": "COMPOSITE",
    "default": {
        "weight": 5,
        "score": 50,
        "result": {
            "level": "LOW",
            "type": "VALUE"
        }
    }
}

Example Request

  • cURL

  • C#

  • Go

  • HTTP

  • Java

  • jQuery

  • NodeJS

  • Python

  • PHP

  • Ruby

  • Swift

curl --location --globoff '{{apiPath}}/environments/{{envID}}/riskPredictors' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{accessToken}}' \
--data '{
    "name": "Composite - including country and user groups",
    "compactName": "compositeWithCountryAndUserGroups",
    "licensed": true,
    "compositions": [
        {
            "condition": {
                "or": [
                    {
                        "equals": 3,
                        "value": "${details.counters.predictorLevels.high}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "equals": "HIGH",
                        "value": "${details.anonymousNetwork.level}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "type": "STRING_LIST",
                        "list": [
                            "Italy",
                            "Germany"
                        ],
                        "notContains": "${details.country}"
                    }
                ]
            },
            "level": "HIGH"
        },
        {
            "condition": {
                "and": [
                    {
                        "equals": "HIGH",
                        "value": "${details.userLocationAnomaly.level}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "list":["networkAdmins"],
                        "notContains":"${event.user.groups}",
                        "type":"GROUPS_INTERSECTION"
                    }
                ]
            },
            "level": "MEDIUM"
        }
    ],
    "type": "COMPOSITE",
    "default": {
        "weight": 5,
        "score": 50,
        "result": {
            "level": "LOW",
            "type": "VALUE"
        }
    }
}'
var options = new RestClientOptions("{{apiPath}}/environments/{{envID}}/riskPredictors")
{
  MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Post);
request.AddHeader("Content-Type", "application/json");
request.AddHeader("Authorization", "Bearer {{accessToken}}");
var body = @"{" + "\n" +
@"    ""name"": ""Composite - including country and user groups""," + "\n" +
@"    ""compactName"": ""compositeWithCountryAndUserGroups""," + "\n" +
@"    ""licensed"": true," + "\n" +
@"    ""compositions"": [" + "\n" +
@"        {" + "\n" +
@"            ""condition"": {" + "\n" +
@"                ""or"": [" + "\n" +
@"                    {" + "\n" +
@"                        ""equals"": 3," + "\n" +
@"                        ""value"": ""${details.counters.predictorLevels.high}""," + "\n" +
@"                        ""type"": ""VALUE_COMPARISON""" + "\n" +
@"                    }," + "\n" +
@"                    {" + "\n" +
@"                        ""equals"": ""HIGH""," + "\n" +
@"                        ""value"": ""${details.anonymousNetwork.level}""," + "\n" +
@"                        ""type"": ""VALUE_COMPARISON""" + "\n" +
@"                    }," + "\n" +
@"                    {" + "\n" +
@"                        ""type"": ""STRING_LIST""," + "\n" +
@"                        ""list"": [" + "\n" +
@"                            ""Italy""," + "\n" +
@"                            ""Germany""" + "\n" +
@"                        ]," + "\n" +
@"                        ""notContains"": ""${details.country}""" + "\n" +
@"                    }" + "\n" +
@"                ]" + "\n" +
@"            }," + "\n" +
@"            ""level"": ""HIGH""" + "\n" +
@"        }," + "\n" +
@"        {" + "\n" +
@"            ""condition"": {" + "\n" +
@"                ""and"": [" + "\n" +
@"                    {" + "\n" +
@"                        ""equals"": ""HIGH""," + "\n" +
@"                        ""value"": ""${details.userLocationAnomaly.level}""," + "\n" +
@"                        ""type"": ""VALUE_COMPARISON""" + "\n" +
@"                    }," + "\n" +
@"                    {" + "\n" +
@"                        ""list"":[""networkAdmins""]," + "\n" +
@"                        ""notContains"":""${event.user.groups}""," + "\n" +
@"                        ""type"":""GROUPS_INTERSECTION""" + "\n" +
@"                    }" + "\n" +
@"                ]" + "\n" +
@"            }," + "\n" +
@"            ""level"": ""MEDIUM""" + "\n" +
@"        }    " + "\n" +
@"    ]," + "\n" +
@"    ""type"": ""COMPOSITE""," + "\n" +
@"    ""default"": {" + "\n" +
@"        ""weight"": 5," + "\n" +
@"        ""score"": 50," + "\n" +
@"        ""result"": {" + "\n" +
@"            ""level"": ""LOW""," + "\n" +
@"            ""type"": ""VALUE""" + "\n" +
@"        }" + "\n" +
@"    }" + "\n" +
@"}";
request.AddStringBody(body, DataFormat.Json);
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);
package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "{{apiPath}}/environments/{{envID}}/riskPredictors"
  method := "POST"

  payload := strings.NewReader(`{
    "name": "Composite - including country and user groups",
    "compactName": "compositeWithCountryAndUserGroups",
    "licensed": true,
    "compositions": [
        {
            "condition": {
                "or": [
                    {
                        "equals": 3,
                        "value": "${details.counters.predictorLevels.high}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "equals": "HIGH",
                        "value": "${details.anonymousNetwork.level}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "type": "STRING_LIST",
                        "list": [
                            "Italy",
                            "Germany"
                        ],
                        "notContains": "${details.country}"
                    }
                ]
            },
            "level": "HIGH"
        },
        {
            "condition": {
                "and": [
                    {
                        "equals": "HIGH",
                        "value": "${details.userLocationAnomaly.level}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "list":["networkAdmins"],
                        "notContains":"${event.user.groups}",
                        "type":"GROUPS_INTERSECTION"
                    }
                ]
            },
            "level": "MEDIUM"
        }
    ],
    "type": "COMPOSITE",
    "default": {
        "weight": 5,
        "score": 50,
        "result": {
            "level": "LOW",
            "type": "VALUE"
        }
    }
}`)

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Content-Type", "application/json")
  req.Header.Add("Authorization", "Bearer {{accessToken}}")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}
POST /environments/{{envID}}/riskPredictors HTTP/1.1
Host: {{apiPath}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
    "name": "Composite - including country and user groups",
    "compactName": "compositeWithCountryAndUserGroups",
    "licensed": true,
    "compositions": [
        {
            "condition": {
                "or": [
                    {
                        "equals": 3,
                        "value": "${details.counters.predictorLevels.high}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "equals": "HIGH",
                        "value": "${details.anonymousNetwork.level}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "type": "STRING_LIST",
                        "list": [
                            "Italy",
                            "Germany"
                        ],
                        "notContains": "${details.country}"
                    }
                ]
            },
            "level": "HIGH"
        },
        {
            "condition": {
                "and": [
                    {
                        "equals": "HIGH",
                        "value": "${details.userLocationAnomaly.level}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "list":["networkAdmins"],
                        "notContains":"${event.user.groups}",
                        "type":"GROUPS_INTERSECTION"
                    }
                ]
            },
            "level": "MEDIUM"
        }
    ],
    "type": "COMPOSITE",
    "default": {
        "weight": 5,
        "score": 50,
        "result": {
            "level": "LOW",
            "type": "VALUE"
        }
    }
}
OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\n    \"name\": \"Composite - including country and user groups\",\n    \"compactName\": \"compositeWithCountryAndUserGroups\",\n    \"licensed\": true,\n    \"compositions\": [\n        {\n            \"condition\": {\n                \"or\": [\n                    {\n                        \"equals\": 3,\n                        \"value\": \"${details.counters.predictorLevels.high}\",\n                        \"type\": \"VALUE_COMPARISON\"\n                    },\n                    {\n                        \"equals\": \"HIGH\",\n                        \"value\": \"${details.anonymousNetwork.level}\",\n                        \"type\": \"VALUE_COMPARISON\"\n                    },\n                    {\n                        \"type\": \"STRING_LIST\",\n                        \"list\": [\n                            \"Italy\",\n                            \"Germany\"\n                        ],\n                        \"notContains\": \"${details.country}\"\n                    }\n                ]\n            },\n            \"level\": \"HIGH\"\n        },\n        {\n            \"condition\": {\n                \"and\": [\n                    {\n                        \"equals\": \"HIGH\",\n                        \"value\": \"${details.userLocationAnomaly.level}\",\n                        \"type\": \"VALUE_COMPARISON\"\n                    },\n                    {\n                        \"list\":[\"networkAdmins\"],\n                        \"notContains\":\"${event.user.groups}\",\n                        \"type\":\"GROUPS_INTERSECTION\"\n                    }\n                ]\n            },\n            \"level\": \"MEDIUM\"\n        }    \n    ],\n    \"type\": \"COMPOSITE\",\n    \"default\": {\n        \"weight\": 5,\n        \"score\": 50,\n        \"result\": {\n            \"level\": \"LOW\",\n            \"type\": \"VALUE\"\n        }\n    }\n}");
Request request = new Request.Builder()
  .url("{{apiPath}}/environments/{{envID}}/riskPredictors")
  .method("POST", body)
  .addHeader("Content-Type", "application/json")
  .addHeader("Authorization", "Bearer {{accessToken}}")
  .build();
Response response = client.newCall(request).execute();
var settings = {
  "url": "{{apiPath}}/environments/{{envID}}/riskPredictors",
  "method": "POST",
  "timeout": 0,
  "headers": {
    "Content-Type": "application/json",
    "Authorization": "Bearer {{accessToken}}"
  },
  "data": JSON.stringify({
    "name": "Composite - including country and user groups",
    "compactName": "compositeWithCountryAndUserGroups",
    "licensed": true,
    "compositions": [
      {
        "condition": {
          "or": [
            {
              "equals": 3,
              "value": "${details.counters.predictorLevels.high}",
              "type": "VALUE_COMPARISON"
            },
            {
              "equals": "HIGH",
              "value": "${details.anonymousNetwork.level}",
              "type": "VALUE_COMPARISON"
            },
            {
              "type": "STRING_LIST",
              "list": [
                "Italy",
                "Germany"
              ],
              "notContains": "${details.country}"
            }
          ]
        },
        "level": "HIGH"
      },
      {
        "condition": {
          "and": [
            {
              "equals": "HIGH",
              "value": "${details.userLocationAnomaly.level}",
              "type": "VALUE_COMPARISON"
            },
            {
              "list": [
                "networkAdmins"
              ],
              "notContains": "${event.user.groups}",
              "type": "GROUPS_INTERSECTION"
            }
          ]
        },
        "level": "MEDIUM"
      }
    ],
    "type": "COMPOSITE",
    "default": {
      "weight": 5,
      "score": 50,
      "result": {
        "level": "LOW",
        "type": "VALUE"
      }
    }
  }),
};

$.ajax(settings).done(function (response) {
  console.log(response);
});
var request = require('request');
var options = {
  'method': 'POST',
  'url': '{{apiPath}}/environments/{{envID}}/riskPredictors',
  'headers': {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer {{accessToken}}'
  },
  body: JSON.stringify({
    "name": "Composite - including country and user groups",
    "compactName": "compositeWithCountryAndUserGroups",
    "licensed": true,
    "compositions": [
      {
        "condition": {
          "or": [
            {
              "equals": 3,
              "value": "${details.counters.predictorLevels.high}",
              "type": "VALUE_COMPARISON"
            },
            {
              "equals": "HIGH",
              "value": "${details.anonymousNetwork.level}",
              "type": "VALUE_COMPARISON"
            },
            {
              "type": "STRING_LIST",
              "list": [
                "Italy",
                "Germany"
              ],
              "notContains": "${details.country}"
            }
          ]
        },
        "level": "HIGH"
      },
      {
        "condition": {
          "and": [
            {
              "equals": "HIGH",
              "value": "${details.userLocationAnomaly.level}",
              "type": "VALUE_COMPARISON"
            },
            {
              "list": [
                "networkAdmins"
              ],
              "notContains": "${event.user.groups}",
              "type": "GROUPS_INTERSECTION"
            }
          ]
        },
        "level": "MEDIUM"
      }
    ],
    "type": "COMPOSITE",
    "default": {
      "weight": 5,
      "score": 50,
      "result": {
        "level": "LOW",
        "type": "VALUE"
      }
    }
  })

};
request(options, function (error, response) {
  if (error) throw new Error(error);
  console.log(response.body);
});
import requests
import json

url = "{{apiPath}}/environments/{{envID}}/riskPredictors"

payload = json.dumps({
  "name": "Composite - including country and user groups",
  "compactName": "compositeWithCountryAndUserGroups",
  "licensed": True,
  "compositions": [
    {
      "condition": {
        "or": [
          {
            "equals": 3,
            "value": "${details.counters.predictorLevels.high}",
            "type": "VALUE_COMPARISON"
          },
          {
            "equals": "HIGH",
            "value": "${details.anonymousNetwork.level}",
            "type": "VALUE_COMPARISON"
          },
          {
            "type": "STRING_LIST",
            "list": [
              "Italy",
              "Germany"
            ],
            "notContains": "${details.country}"
          }
        ]
      },
      "level": "HIGH"
    },
    {
      "condition": {
        "and": [
          {
            "equals": "HIGH",
            "value": "${details.userLocationAnomaly.level}",
            "type": "VALUE_COMPARISON"
          },
          {
            "list": [
              "networkAdmins"
            ],
            "notContains": "${event.user.groups}",
            "type": "GROUPS_INTERSECTION"
          }
        ]
      },
      "level": "MEDIUM"
    }
  ],
  "type": "COMPOSITE",
  "default": {
    "weight": 5,
    "score": 50,
    "result": {
      "level": "LOW",
      "type": "VALUE"
    }
  }
})
headers = {
  'Content-Type': 'application/json',
  'Authorization': 'Bearer {{accessToken}}'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)
<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{apiPath}}/environments/{{envID}}/riskPredictors');
$request->setMethod(HTTP_Request2::METHOD_POST);
$request->setConfig(array(
  'follow_redirects' => TRUE
));
$request->setHeader(array(
  'Content-Type' => 'application/json',
  'Authorization' => 'Bearer {{accessToken}}'
));
$request->setBody('{\n    "name": "Composite - including country and user groups",\n    "compactName": "compositeWithCountryAndUserGroups",\n    "licensed": true,\n    "compositions": [\n        {\n            "condition": {\n                "or": [\n                    {\n                        "equals": 3,\n                        "value": "${details.counters.predictorLevels.high}",\n                        "type": "VALUE_COMPARISON"\n                    },\n                    {\n                        "equals": "HIGH",\n                        "value": "${details.anonymousNetwork.level}",\n                        "type": "VALUE_COMPARISON"\n                    },\n                    {\n                        "type": "STRING_LIST",\n                        "list": [\n                            "Italy",\n                            "Germany"\n                        ],\n                        "notContains": "${details.country}"\n                    }\n                ]\n            },\n            "level": "HIGH"\n        },\n        {\n            "condition": {\n                "and": [\n                    {\n                        "equals": "HIGH",\n                        "value": "${details.userLocationAnomaly.level}",\n                        "type": "VALUE_COMPARISON"\n                    },\n                    {\n                        "list":["networkAdmins"],\n                        "notContains":"${event.user.groups}",\n                        "type":"GROUPS_INTERSECTION"\n                    }\n                ]\n            },\n            "level": "MEDIUM"\n        }    \n    ],\n    "type": "COMPOSITE",\n    "default": {\n        "weight": 5,\n        "score": 50,\n        "result": {\n            "level": "LOW",\n            "type": "VALUE"\n        }\n    }\n}');
try {
  $response = $request->send();
  if ($response->getStatus() == 200) {
    echo $response->getBody();
  }
  else {
    echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
    $response->getReasonPhrase();
  }
}
catch(HTTP_Request2_Exception $e) {
  echo 'Error: ' . $e->getMessage();
}
require "uri"
require "json"
require "net/http"

url = URI("{{apiPath}}/environments/{{envID}}/riskPredictors")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/json"
request["Authorization"] = "Bearer {{accessToken}}"
request.body = JSON.dump({
  "name": "Composite - including country and user groups",
  "compactName": "compositeWithCountryAndUserGroups",
  "licensed": true,
  "compositions": [
    {
      "condition": {
        "or": [
          {
            "equals": 3,
            "value": "\${details.counters.predictorLevels.high}",
            "type": "VALUE_COMPARISON"
          },
          {
            "equals": "HIGH",
            "value": "\${details.anonymousNetwork.level}",
            "type": "VALUE_COMPARISON"
          },
          {
            "type": "STRING_LIST",
            "list": [
              "Italy",
              "Germany"
            ],
            "notContains": "\${details.country}"
          }
        ]
      },
      "level": "HIGH"
    },
    {
      "condition": {
        "and": [
          {
            "equals": "HIGH",
            "value": "\${details.userLocationAnomaly.level}",
            "type": "VALUE_COMPARISON"
          },
          {
            "list": [
              "networkAdmins"
            ],
            "notContains": "\${event.user.groups}",
            "type": "GROUPS_INTERSECTION"
          }
        ]
      },
      "level": "MEDIUM"
    }
  ],
  "type": "COMPOSITE",
  "default": {
    "weight": 5,
    "score": 50,
    "result": {
      "level": "LOW",
      "type": "VALUE"
    }
  }
})

response = http.request(request)
puts response.read_body
let parameters = "{\n    \"name\": \"Composite - including country and user groups\",\n    \"compactName\": \"compositeWithCountryAndUserGroups\",\n    \"licensed\": true,\n    \"compositions\": [\n        {\n            \"condition\": {\n                \"or\": [\n                    {\n                        \"equals\": 3,\n                        \"value\": \"${details.counters.predictorLevels.high}\",\n                        \"type\": \"VALUE_COMPARISON\"\n                    },\n                    {\n                        \"equals\": \"HIGH\",\n                        \"value\": \"${details.anonymousNetwork.level}\",\n                        \"type\": \"VALUE_COMPARISON\"\n                    },\n                    {\n                        \"type\": \"STRING_LIST\",\n                        \"list\": [\n                            \"Italy\",\n                            \"Germany\"\n                        ],\n                        \"notContains\": \"${details.country}\"\n                    }\n                ]\n            },\n            \"level\": \"HIGH\"\n        },\n        {\n            \"condition\": {\n                \"and\": [\n                    {\n                        \"equals\": \"HIGH\",\n                        \"value\": \"${details.userLocationAnomaly.level}\",\n                        \"type\": \"VALUE_COMPARISON\"\n                    },\n                    {\n                        \"list\":[\"networkAdmins\"],\n                        \"notContains\":\"${event.user.groups}\",\n                        \"type\":\"GROUPS_INTERSECTION\"\n                    }\n                ]\n            },\n            \"level\": \"MEDIUM\"\n        }    \n    ],\n    \"type\": \"COMPOSITE\",\n    \"default\": {\n        \"weight\": 5,\n        \"score\": 50,\n        \"result\": {\n            \"level\": \"LOW\",\n            \"type\": \"VALUE\"\n        }\n    }\n}"
let postData = parameters.data(using: .utf8)

var request = URLRequest(url: URL(string: "{{apiPath}}/environments/{{envID}}/riskPredictors")!,timeoutInterval: Double.infinity)
request.addValue("application/json", forHTTPHeaderField: "Content-Type")
request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization")

request.httpMethod = "POST"
request.httpBody = postData

let task = URLSession.shared.dataTask(with: request) { data, response, error in
  guard let data = data else {
    print(String(describing: error))
    return
  }
  print(String(data: data, encoding: .utf8)!)
}

task.resume()

Example Response

201 Created

{
    "_links": {
        "self": {
            "href": "https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/riskPredictors/abfbd59d-c390-4acf-bd74-305973ed9b7c"
        },
        "environment": {
            "href": "https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
        }
    },
    "id": "abfbd59d-c390-4acf-bd74-305973ed9b7c",
    "environment": {
        "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
    },
    "createdAt": "2024-07-21T15:27:58.924Z",
    "createdBy": "USER_DEFINED",
    "updatedAt": "2024-07-21T15:27:58.924Z",
    "name": "Composite - including country and user groups",
    "compactName": "compositeWithCountryAndUserGroups",
    "licensed": true,
    "compositions": [
        {
            "condition": {
                "or": [
                    {
                        "equals": 3,
                        "value": "${details.counters.predictorLevels.high}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "equals": "HIGH",
                        "value": "${details.anonymousNetwork.level}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "list": [
                            "Italy",
                            "Germany"
                        ],
                        "notContains": "${details.country}",
                        "type": "STRING_LIST"
                    }
                ],
                "type": "OR"
            },
            "level": "HIGH"
        },
        {
            "condition": {
                "and": [
                    {
                        "equals": "HIGH",
                        "value": "${details.userLocationAnomaly.level}",
                        "type": "VALUE_COMPARISON"
                    },
                    {
                        "list": [
                            "networkAdmins"
                        ],
                        "notContains": "${event.user.groups}",
                        "type": "GROUPS_INTERSECTION"
                    }
                ],
                "type": "AND"
            },
            "level": "MEDIUM"
        }
    ],
    "type": "COMPOSITE",
    "composition": {
        "condition": {
            "or": [
                {
                    "equals": 3,
                    "value": "${details.counters.predictorLevels.high}",
                    "type": "VALUE_COMPARISON"
                },
                {
                    "equals": "HIGH",
                    "value": "${details.anonymousNetwork.level}",
                    "type": "VALUE_COMPARISON"
                },
                {
                    "list": [
                        "Italy",
                        "Germany"
                    ],
                    "notContains": "${details.country}",
                    "type": "STRING_LIST"
                }
            ],
            "type": "OR"
        },
        "level": "HIGH"
    },
    "condition": {
        "scores": [
            {
                "name": "HIGH",
                "value": "HIGH"
            },
            {
                "name": "MEDIUM",
                "value": "MEDIUM"
            },
            {
                "name": "LOW",
                "value": "LOW"
            }
        ]
    },
    "tooltip": "predictor.tooltip.composite",
    "deletable": true,
    "default": {
        "weight": 5,
        "score": 50,
        "result": {
            "level": "LOW",
            "type": "VALUE"
        },
        "evaluated": false
    }
}