Skip to content
AWS for Query.Farm

aws.frauddetector.get_event_prediction

Example SQL Queries

SELECT * FROM
aws.frauddetector.get_event_prediction
WHERE
"detector_id" = 'VALUE'
AND "event_id" = 'VALUE'
AND "event_type_name" = 'VALUE'
AND "entities" = 'VALUE'
AND "event_timestamp" = 'VALUE'
AND "event_variables" = 'VALUE';

Description

Evaluates an event against a detector version. If a version ID is not provided, the detector’s (ACTIVE) version is used.

Table Definition

Column NameColumn Data Type
detector_id Required Input Column

The detector ID.

VARCHAR
entities Required Input Column

The entity type (associated with the detector's event type) and specific entity ID representing who performed the event. If an entity id is not available, use "UNKNOWN."

STRUCT(
    "entity_type" VARCHAR,
    "entity_id" VARCHAR
)[]
Show child fields
entities[]
Show child fields
entities[].entity_id

The entity ID. If you do not know the entityId, you can pass unknown, which is areserved string literal.

entities[].entity_type

The entity type.

event_id Required Input Column

The unique ID used to identify the event.

VARCHAR
event_timestamp Required Input Column

Timestamp that defines when the event under evaluation occurred. The timestamp must be specified using ISO 8601 standard in UTC.

VARCHAR
event_type_name Required Input Column

The event type associated with the detector specified for the prediction.

VARCHAR
event_variables Required Input Column

Names of the event type's variables you defined in Amazon Fraud Detector to represent data elements and their corresponding values for the event you are sending for evaluation.

You must provide at least one eventVariable

To ensure most accurate fraud prediction and to simplify your data preparation, Amazon Fraud Detector will replace all missing variables or values as follows:

For Amazon Fraud Detector trained models:

If a null value is provided explicitly for a variable or if a variable is missing, model will replace the null value or the missing variable (no variable name in the eventVariables map) with calculated default mean/medians for numeric variables and with special values for categorical variables.

For imported SageMaker models:

If a null value is provided explicitly for a variable, the model and rules will use “null” as the value. If a variable is not provided (no variable name in the eventVariables map), model and rules will use the default value that is provided for the variable. 

MAP(VARCHAR, VARCHAR)
detector_version_id Input Column

The detector version ID.

VARCHAR
external_model_endpoint_data_blobs Input Column

The Amazon SageMaker model endpoint input data blobs.

MAP(VARCHAR, STRUCT(
        "byte_buffer" BLOB,
        "content_type" VARCHAR
    ))
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
external_model_outputs

The model scores for Amazon SageMaker models.

STRUCT(
    "external_model" STRUCT(
        "model_endpoint" VARCHAR,
        "model_source" VARCHAR
    ),
    "outputs" MAP(VARCHAR, VARCHAR)
)[]
Show child fields
external_model_outputs[]
Show child fields
external_model_outputs[].external_model

The Amazon SageMaker model.

Show child fields
external_model_outputs[].external_model.model_endpoint

The endpoint of the Amazon SageMaker model.

external_model_outputs[].external_model.model_source

The source of the model.

external_model_outputs[].outputs

The fraud prediction scores from Amazon SageMaker model.

model_scores

The model scores. Amazon Fraud Detector generates model scores between 0 and 1000, where 0 is low fraud risk and 1000 is high fraud risk. Model scores are directly related to the false positive rate (FPR). For example, a score of 600 corresponds to an estimated 10% false positive rate whereas a score of 900 corresponds to an estimated 2% false positive rate.

STRUCT(
    "model_version" STRUCT(
        "model_id" VARCHAR,
        "model_type" VARCHAR,
        "model_version_number" VARCHAR,
        "arn" VARCHAR
    ),
    "scores" MAP(VARCHAR, DOUBLE)
)[]
Show child fields
model_scores[]
Show child fields
model_scores[].model_version

The model version.

Show child fields
model_scores[].model_version.arn

The model version ARN.

model_scores[].model_version.model_id

The model ID.

model_scores[].model_version.model_type

The model type.

model_scores[].model_version.model_version_number

The model version number.

model_scores[].scores

The model's fraud prediction scores.

rule_results

The results from the rules.

STRUCT(
    "rule_id" VARCHAR,
    "outcomes" VARCHAR[]
)[]
Show child fields
rule_results[]
Show child fields
rule_results[].outcomes[]
rule_results[].rule_id

The rule ID that was matched, based on the rule execution mode.