Live · Refreshed 30 sec ago · OIG workspace

7 active fraud alerts, 2 high-risk,
1 escalated to investigation in the last hour.

Detection rules fired 312 times in the last 7 days — 96% auto-cleared by deterministic logic, 4% surfaced for human review. The OIG audit's Recommendation 5 controls are operating at expected sensitivity.

Tune detection rules Open investigation ↗
Severity · All Status · Open Rule · All + Add filter
Active alerts
7
2 high-risklast 7d
Detections · 7d
312
96% auto-cleared
Mean time to triage
14min
▼ 4 mintarget ≤ 20
Open investigations
3
+1vs. last week
Alert triage queue
Risk-scored · highest severity first · click any alert to open investigation workspace
2 high 3 medium 2 low
ALT-2026-0142 · D. Romero · "Clock-in, leave, clock-out" pattern
CR-007 · risk 92 3 occurrences in 14 days ~$3,840 estimated exposure Last fired 32 min ago
14.0 hrs
$1,680
Open
ALT-2026-0141 · M. Adeyemi · 13 consecutive days exceeding 10 hrs
CR-005 + CR-006 · risk 86 2.4σ above peer median Pattern started 14d ago
128 hrs
$16,640
ALT-2026-0140 · L. Patel · Self-approval attempt blocked
CR-001 · risk 64 2nd attempt this quarter Forwarded to backup approver
10.0 hrs
$1,200
ALT-2026-0139 · J. Okafor · Peer-comparison outlier
CR-006 · risk 58 +62% vs Maintenance Mechanic peers Cluster of 3 employees
82 hrs
$10,660
ALT-2026-0138 · K. Tran · Missed-lunch frequency spike
CR-004 · risk 52 3 missed lunches in 14 days Possible work-rule conflict
—
—
ALT-2026-0137 · B. Lee · Aggregate cap minor breach
CR-003 · risk 28 46 hrs vs 44 cap Single occurrence · auto-low
2.0 hrs
$240
ALT-2026-0136 · N. Aguilar · Cross-team approval flag
CR-002 · risk 22 Approver outside reporting line Pre-authorized by COO memo · auto-low
6.0 hrs
$540
Detection rule firing rates · 7d
Top firing rules · click to drill into samples
Tune rules ↗
CR-007 · Punch-pattern anomaly
Most precise · 0.4% false-positive
32fires
CR-005 · Consecutive-day threshold
Threshold: 8 days
78fires
CR-006 · Peer outlier
Threshold: 2σ above classification median
64fires
CR-003 · Aggregate cap
Weekly & monthly caps
56fires
CR-001 · Self-approval block
Hard block · no overrides
28fires
Audit trail · last 24h
Complete record · cryptographically anchored
11:42 AM · today
Alert ALT-2026-0142 escalated to investigation by A. Thompson
D. Romero · CR-007 fired 3rd time · case INV-2026-018 created
11:18 AM · today
CR-005 threshold preview run by A. Thompson
8d → 9d would reduce fires by 22% · 0 missed prior incidents
10:42 AM · today
312 detection events processed · 4% surfaced (12)
Auto-test fabric · all rules passed regression
09:30 AM · today
Quarterly compliance report exported to BART OIG records
5/5 OIG recommendations operating in green
06:00 AM · today
Synthetic data fabric: 14,820 punches ingested from prior day
PeopleSoft Time & Labor · TCD · Maximo