Same-day rules
An analyst writes the rule, tests it against recorded events, and publishes it. Response time to a new pattern is measured against the pattern, not the sprint.
Fraud detection
Device signals, identity checks and behavioural rules in one flow — with the borderline cases routed to a human instead of guessed at.
The problem
An attack pattern is usually obvious within hours of it starting, and the rule that stops it is usually simple. The delay is almost never the analysis — it is the distance between the analyst who found the pattern and the deploy that can act on it.
The second cost is the blunt instrument. When shipping a rule is expensive, teams ship rules that are too broad, and good customers get declined to catch a handful of bad ones. Cheap changes make precise rules affordable.
What the flow looks like
A signup, a login, a payment, a change of bank details — whatever you want scored, against a schema you define.
Device intelligence, identity and document checks from your providers, pulled in parallel where they do not depend on each other.
What this customer, device or account did before. Velocity and repeat-pattern rules need memory, not just the current request.
The unambiguous cases — a sanctioned party, a known-bad device, an impossible velocity — stop here rather than consuming review capacity.
Run your own model on the features assembled above. The model is versioned with the flow, so a score is always attributable to a specific model and a specific policy.
Low risk passes, high risk blocks, and the band in between goes to a human — an explicit branch rather than a threshold hidden in code.
The reviewer gets a case with the signals, the score and the reason it was flagged already attached, instead of a customer ID and a hunt.
Allow, block or review, with the rule that fired and the version that produced it.
Data you can pull in
A Connection node calls the providers you already pay for, with your credentials. ArboRule decides which calls to make and what the answers mean together — it does not resell the data or sit between you and your vendor.
What changes
An analyst writes the rule, tests it against recorded events, and publishes it. Response time to a new pattern is measured against the pattern, not the sprint.
When a rule costs an afternoon rather than a release, it is affordable to write the narrow one that catches the attack without catching your customers.
Cases arrive carrying the signals and the reason. The review is a judgment call, not an investigation into what the system was thinking.
Questions
Yes. An ML Model node runs your model inside the flow on features the flow assembled, and the model version is pinned alongside the policy version — so any score can be traced to the exact model and logic that produced it.
With an explicit branch. A Split node routes the middle band to a human: a Manual Review node pauses the decision until someone answers, or a Create Case node opens a case for a reviewer while the flow returns a referral. Both are visible on the canvas rather than implied by a threshold.
Yes. Read Entity nodes look up the history you have recorded for a customer, device or account, which is what velocity, repeat-attempt and pattern rules need to work.
Ready when you are
Build the flow in Sandbox, run your own cases through it, and see the trace before anything reaches a customer.