Skip to content
AWS for Query.Farm

aws.frauddetector.get_event_prediction_metadata

Example SQL Queries

SELECT * FROM
aws.frauddetector.get_event_prediction_metadata
WHERE
"event_id" = 'VALUE'
AND "event_type_name" = 'VALUE'
AND "detector_id" = 'VALUE'
AND "detector_version_id" = 'VALUE'
AND "prediction_timestamp" = 'VALUE';

Description

Gets details of the past fraud predictions for the specified event ID, event type, detector ID, and detector version ID that was generated in the specified time period.

Table Definition

Column NameColumn Data Type
detector_id Required Input Column

The detector ID. 

VARCHAR
detector_version_id Required Input Column

The detector version ID. 

VARCHAR
event_id Required Input Column

The event ID. 

VARCHAR
event_type_name Required Input Column

The event type associated with the detector specified for this prediction. 

VARCHAR
prediction_timestamp Required Input Column

The timestamp that defines when the prediction was generated. 

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
detector_version_status

The status of the detector version. 

VARCHAR
entity_id

The entity ID. 

VARCHAR
entity_type

The entity type. 

VARCHAR
evaluated_external_models

External (Amazon SageMaker) models that were evaluated for generating predictions. 

STRUCT(
    "model_endpoint" VARCHAR,
    "use_event_variables" BOOLEAN,
    "input_variables" MAP(VARCHAR, VARCHAR),
    "output_variables" MAP(VARCHAR, VARCHAR)
)[]
Show child fields
evaluated_external_models[]
Show child fields
evaluated_external_models[].input_variables

Input variables use for generating predictions.

evaluated_external_models[].model_endpoint

The endpoint of the external (Amazon Sagemaker) model.

evaluated_external_models[].output_variables

Output variables.

evaluated_external_models[].use_event_variables

Indicates whether event variables were used to generate predictions.

evaluated_model_versions

Model versions that were evaluated for generating predictions. 

STRUCT(
    "model_id" VARCHAR,
    "model_version" VARCHAR,
    "model_type" VARCHAR,
    "evaluations" STRUCT(
        "output_variable_name" VARCHAR,
        "evaluation_score" VARCHAR,
        "prediction_explanations" STRUCT(
            "variable_impact_explanations" STRUCT(
                "event_variable_name" VARCHAR,
                "relative_impact" VARCHAR,
                "log_odds_impact" DOUBLE
            )[],
            "aggregated_variables_impact_explanations" STRUCT(
                "event_variable_names" VARCHAR[],
                "relative_impact" VARCHAR,
                "log_odds_impact" DOUBLE
            )[]
        )
    )[]
)[]
Show child fields
evaluated_model_versions[]
Show child fields
evaluated_model_versions[].evaluations[]
Show child fields
evaluated_model_versions[].evaluations[].evaluation_score

The evaluation score generated for the model version.

evaluated_model_versions[].evaluations[].output_variable_name

The output variable name.

evaluated_model_versions[].evaluations[].prediction_explanations

The prediction explanations generated for the model version.

Show child fields
evaluated_model_versions[].evaluations[].prediction_explanations.aggregated_variables_impact_explanations[]
Show child fields
evaluated_model_versions[].evaluations[].prediction_explanations.aggregated_variables_impact_explanations[].event_variable_names[]
evaluated_model_versions[].evaluations[].prediction_explanations.aggregated_variables_impact_explanations[].log_odds_impact

The raw, uninterpreted value represented as log-odds of the fraud. These values are usually between -10 to +10, but range from -infinity to +infinity.

  • A positive value indicates that the variables drove the risk score up.

  • A negative value indicates that the variables drove the risk score down.

evaluated_model_versions[].evaluations[].prediction_explanations.aggregated_variables_impact_explanations[].relative_impact

The relative impact of the aggregated variables in terms of magnitude on the prediction scores.

evaluated_model_versions[].evaluations[].prediction_explanations.variable_impact_explanations[]
Show child fields
evaluated_model_versions[].evaluations[].prediction_explanations.variable_impact_explanations[].event_variable_name

The event variable name.

evaluated_model_versions[].evaluations[].prediction_explanations.variable_impact_explanations[].log_odds_impact

The raw, uninterpreted value represented as log-odds of the fraud. These values are usually between -10 to +10, but range from - infinity to + infinity.

  • A positive value indicates that the variable drove the risk score up.

  • A negative value indicates that the variable drove the risk score down.

evaluated_model_versions[].evaluations[].prediction_explanations.variable_impact_explanations[].relative_impact

The event variable's relative impact in terms of magnitude on the prediction scores. The relative impact values consist of a numerical rating (0-5, 5 being the highest) and direction (increased/decreased) impact of the fraud risk.

evaluated_model_versions[].model_id

The model ID.

evaluated_model_versions[].model_type

The model type.

Valid values: ONLINE_FRAUD_INSIGHTS | TRANSACTION_FRAUD_INSIGHTS

evaluated_model_versions[].model_version

The model version.

event_timestamp

The timestamp for when the prediction was generated for the associated event ID. 

VARCHAR
event_variables

A list of event variables that influenced the prediction scores. 

STRUCT(
    "name" VARCHAR,
    "value" VARCHAR,
    "source" VARCHAR
)[]
Show child fields
event_variables[]
Show child fields
event_variables[].name

The event variable name.

event_variables[].source

The event variable source.

event_variables[].value

The value of the event variable.

outcomes

The outcomes of the matched rule, based on the rule execution mode. 

VARCHAR[]
Show child fields
outcomes[]
rule_execution_mode

The execution mode of the rule used for evaluating variable values. 

VARCHAR
rules

List of rules associated with the detector version that were used for evaluating variable values. 

STRUCT(
    "rule_id" VARCHAR,
    "rule_version" VARCHAR,
    "expression" VARCHAR,
    "expression_with_values" VARCHAR,
    "outcomes" VARCHAR[],
    "evaluated" BOOLEAN,
    "matched" BOOLEAN
)[]
Show child fields
rules[]
Show child fields
rules[].evaluated

Indicates whether the rule was evaluated.

rules[].expression

The rule expression.

rules[].expression_with_values

The rule expression value.

rules[].matched

Indicates whether the rule matched.

rules[].outcomes[]
rules[].rule_id

The rule ID.

rules[].rule_version

The rule version.