Questions about implementation of RBA and ATO in CDC

[SAPSupport]

• • Which field does SAP CDC use for RBA and ATO rules?
  • What impact will we have on RBA/ATO rules if the fields "ip" and "serverIP" are used to determine risk?
  • What are the uses of the mentioned fields "ip", "serverIP".
  • How is the 'country' field of the 'httpReq' obtained?
  • What does the 'riskScore' field depend on? In the explained case where the IP is not the end user's, what impact would it have?

------------------------------------------------------------------------------------------------------------------------------------------------
Learn more about the SAP Support user and program here.

[SAPSupport · Accepted solution]

To answer on questions make sure to review following documentation:

RBA Rule - Action Tab  

RBA Risk factors 

ATO

3211900 - What risk score threshold should be used to trigger a CAPTCHA when setting up policies thr...