The recommended approach for defining this threshold is:
- Run the model without defining a rule and then examine the value of the Model Score value in the Transaction Summary report. Export a day of the report and look at the distribution of the scores. Set the threshold so that 5% (suggested) of the scores are above the threshold.
You can use Excel for this quickly. Open the exported file in Excel. It will have one row for each risk analysis. Sort it on the Model Score column from high to low. The transaction 5% down the sorted report will have the Model Score that is appropriate for a 5% challenge threshold.
2. Create a rule with the score threshold from the analysis above. Prioritize the rule close to the bottom of the list. Generally rules that are testing for specific, hard, policies such as blacklisting certain countries and exception user check, should go before the user behavior profiling rule or rules