IBM Financial Crimes Alerts Insight with Watson Version Solution Guide IBM

Transcription

1 IBM Financial Crimes Alerts Insight with Watson Version Solution Guide IBM

2

3 Note Before using this information and the product it supports, read the information in Notices on page 77. Copyright IBM Corp iii

4 Product Information This document applies to Version and may also apply to subsequent releases. Licensed Materials - Property of IBM iv IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

5 Contents Note... iii... iv Introduction... ix Chapter 1. Solution overview... 1 Deployment topology...1 Chapter 2. Install a small deployment of IBM Financial Crimes Alerts Insight...5 Preparing for installation... 5 System requirements... 5 RAM requirements verification...5 Verifying host name configuration... 5 Validating Linux umask settings...6 Verifying server to server connectivity...7 Verifying the key fingerprints for each server...8 Verifying disk space...8 Installing PyYAML on the Ambari server...9 Installing Docker and configuring a Docker registry Downloading and extracting the small deployment installation files Deploying the IBM FCAI images to the Docker registry in a small deployment Configuring access in a small deployment...12 User security in a small deployment...12 Setting up Active Directory for a small deployment...13 LDAP integration in a small deployment...14 SSO integration in a small deployment...15 Integration with a case manager application in a small deployment...16 Customizing the properties for the Docker containers...16 Managing certificates to connect to other services in a small deployment Deploying the IBM FCAI Docker containers...17 Running the Hadoop installation and configuration packages...18 Customizing the properties for the Hadoop configuration Creating and configuring the Hadoop cluster for IBM FCAI small deployment...19 Chapter 3. Install a medium deployment of IBM Financial Crimes Alerts Insight...21 Preparing for installation System requirements RAM requirements verification Verifying host name configuration Validating Linux umask settings Verifying server to server connectivity Verifying the key fingerprints for each server...25 Verifying disk space...26 Mounting NFS directories...27 Install PyYAML...27 Download and extract the medium deployment installation files Kubernetes artifacts and Docker images...27 Hadoop configuration packages Setting up the DB2 instance on the NFS directory Customizing the properties for the Hadoop configuration Customizing the properties for the Kubernetes deployment Managing certificates to connect to other services...31 v

6 Configuring access...32 User security...32 Setting up Active Directory LDAP integration...34 SSO integration...34 Integration with a case manager application Creating and configuring the Hadoop cluster for IBM FCAI Deploying the IBM FCAI images to Docker Deploying the IBM FCAI artifacts to Kubernetes...38 Chapter 4. Configuration tasks Configuring the database...39 Configure the analytics Run the analytics...43 Ingesting the data Training the model...44 Scheduling transaction processing...45 Processing alerts Set analytic thresholds Enable alert messaging Integrate entity resolution with the FCI platform...49 Validating the bulk-load properties and setting up the SSHFS mount Configure FCI platform to allow bulk loading party data Configuring insights Configuring an insight type...51 Configuring features in an insight type description...51 Associating an insight type with a reason type Configuring narrative templates...52 Editing narrative templates...53 Narrative template variables...53 Chapter 5. Use IBM Financial Crimes Alerts Insight with Watson (FCAI) View alerts...57 Using the link analysis view Using the 6 Month Variance view...58 Using the Transaction History view...58 Generating a narrative...59 Use the dashboard...59 Accessing the dashboard Viewing alerts as a list...60 Viewing alerts grouped by customer name Sorting alerts Filtering alerts Searching for alerts Specifying a status for an alert Exporting alerts Opening an alerts insight view Chapter 6. Log messages Filebeat Logstash Elasticsearch...67 Kibana Chapter 7. Formatting data files Appendix A. Accessibility features vi

7 Appendix B. Software License Metric (SLM) usage Notices...77 vii

8 viii

9 Introduction IBM Financial Crimes Alerts Insight with Watson (FCAI) is designed to reduce the overall cost of monitoring transactions while also complying with anti-money laundering regulations. The solution is designed to save time and money while also protecting financial institutions from fraud. IBM FCAI helps financial and non-financial institutions to reduce exposure to money laundering and terrorism financing activities. It effectively monitors bank customer transactions daily and by using customer historical information and account profiles, it provides a whole picture to the bank management. Audience This guide is intended for administrators and users of the solution. It provides information on installation and configuration of the solution, and information about using the solution. Finding information and getting help To find product documentation on the web, access IBM Knowledge Center ( knowledgecenter). Accessibility features Accessibility features help users who have a physical disability, such as restricted mobility or limited vision, to use information technology products. For more information, see Appendix A, Accessibility features, on page 73. The HTML documentation has accessibility features. PDF documents are supplemental and, as such, include no added accessibility features. Forward-looking statements This documentation describes the current functionality of the product. References to items that are not currently available may be included. No implication of any future availability should be inferred. Any such references are not a commitment, promise, or legal obligation to deliver any material, code, or functionality. The development, release, and timing of features or functionality remain at the sole discretion of IBM. Samples disclaimer Sample files may contain fictional data manually or machine generated, factual data that is compiled from academic or public sources, or data that is used with permission of the copyright holder, for use as sample data to develop sample applications. Product names that are referenced may be the trademarks of their respective owners. Unauthorized duplication is prohibited. Copyright IBM Corp ix

10 x IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

11 Chapter 1. Solution overview The IBM Financial Crimes Alerts Insight with Watson (FCAI) solution uses advanced analytics to identify behaviors that can help prevent financial crime before it happens while also investigating occurrences to minimize negative financial impact. Financial crimes are growing in frequency and complexity and technological advances provide malicious insiders and organized criminals more opportunity to commit crimes. At the same time, business must remain compliant. New regulatory guidelines continue to arise with increased scrutiny and complexity, challenging even the most advanced compliance programs. Suspicious activity reports (SARs) increasingly cross boundaries between fraud, cyber, and anti-money laundering (AML), further increasing the complexity. Regulators are pushing for more detailed reviews of implementations, especially for knowing your customer (KYC) requirements. Keeping up with compliance risks can be difficult and costly, with high false positive rates. The solution Continuously harnesses a powerful array of advanced analytics that are available to proactively fight the long-term war against financial criminals on multiple fronts. Helps you to more effectively resolve identities, relationships, and ambiguous patterns with entity and predictive analytics, broader cross channel visibility, and stronger risk scoring. Continuously adapts and embeds new operating models through retrospective forensic and big data techniques. Helps accelerate investigations and the management of cases through SAR filings with improved triage alerts, automation, and deep mining of data sets. Deployment topology IBM Financial Crimes Alerts Insight with Watson (FCAI) is typically deployed across several computers. Small deployment topology A small topology deployment uses 3 server computers: a Hadoop master, a Hadoop gateway, and an Ambari server. Copyright IBM Corp

12 Ambari Ambari server Docker Engine fcai-node image User Ambari server port 8081 port fci_memoryds image fci-loganalysis image fci-logvisualization image fci-logsearch image port fcai-db image Ambari server ports / (DB2 SSL / TCP) Hadoop master Ambari agent HiveServer2 HDFS NameNode YARN ResourceManager Zookeeper Hadoop slave Ambari agent Flume HDFS DataNode HDFS NFS gateway Hadoop clients (Spark2, Hive, etc) Zookeeper Figure 1: Small deployment topology Medium deployment topology The following diagram shows solution architecture for a medium-sized deployment of IBM FCAI: 2 IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

13 Hadoop cluster Gateway R Ambari Secondary Slave 2 Slave 1 Master port Nodejs contacts Redis for Denial-of-service (DoS) on /login/ldap fcaidb fcaies fcaikb Kubernetes 1 Kubernetes 2 fcails fcainodejs redis (memoryds) OpenLDAP (optional) Kubernetes cluster Control Plane REST Docker registry fci-solution fci-analytics... fcai-node fcai-db fcai-logstash Kubernetes Master NFS server /fci-exports /fci-solution... /amldb /amles User HTTPS port Figure 2: Medium deployment solution architecture The following diagram shows a medium deployment topology for IBM FCAI. The medium deployment topology provides higher capacity and quality of service in a production environment. Solution overview 3

14 Kubernetes Master API server Scheduler Controller Manager NFS Kubernetes worker 1 & 2 Nodejs container DB2 container Logstash container Elasticsearch container Kibana container Ambari Ambari Server HTTP Server Hadoop secondary Hadoop master HBase Master Grafana Spark2 History Server App Timeline Server HDFS Client Metrics Monitor WebHCat Server HDFS Client Hive Client MySQL Server YARN Client History Server HiveServer2 Pig Client Zookeeper Client Hive Metastore Kafka Broker SNameNode Zookeeper Server MapReduce2 Client MapReduce2 Client Metrics Collector Metrics Monitor Hadoop gateway DataNode Flume MapReduce2 Client Metrics Monitor Slider Client Spark2 Client NameNode ResourceManager Spark2 Client HBase Client NFSGateway Spark2 Thrift Server YARN Client HCat Client HDFS Client NodeManager Pig Client YARN Client Zookeeper Client ZooKeeper Server Hive Client Zookeeper Server Hadoop slave 1 & 2 DataNode Hive Client Slider Client HBase Client MapReduce2 Client Spark2 Client RegionServer Metrics Monitor Spark2 Thrift Server HBaseRestServer NodeManager YARN Client HCat Client Pig Client Zookeeper Client HDFS Client Figure 3: Medium deployment topology 4 IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

15 Chapter 2. Install a small deployment of IBM Financial Crimes Alerts Insight After you have prepared your environment for installation, and ensured all system requirements are met, you are ready to install IBM Financial Crimes Alerts Insight with Watson (FCAI). You can install IBM FCAI along with the IBM Financial Crimes Insight with Watson platform. Or, you can install it separately. If you install it separately, you must still install some of the components from the IBM Financial Crimes Insight with Watson platform. Preparing for installation Before you install an IBM Financial Crimes Alerts Insight with Watson (FCAI) small deployment, you must complete several preinstallation tasks. System requirements Ensure that you meet the minimum system requirements for an IBM Financial Crimes Alerts Insight with Watson (FCAI) small deployment installation. To review an up-to-date list of environments that are supported by IBM Financial Crimes Alerts Insight with Watson (FCAI), such as supported software and compatible web browsers, see the Software Requirements. You must also verify that yum is properly configured. Run the following command on each server, and ensure that the status shows a value that is greater than zero: yum repolist RAM requirements verification Ensure that the computers where you plan to install an IBM Financial Crimes Alerts Insight with Watson (FCAI) small deployment meet the minimum operating system, CPU, RAM, and disk space. To view the minimum operating system, CPU, RAM, and disk space that is required to install IBM FCAI, view the Software Requirements page. The following table provides the required and recommended RAM for running IBM FCAI. Table 1: Small deployment RAM requirements Server role (node name) Required minimum RAM Ambari server (ambari) 24 GB 32 GB Hadoop servers (hadoop-master, hadoop-slave) 24 GB 32 GB Recommended minimum RAM Note: As the amount of RAM that you might need varies depending on the server load, the recommended RAM amount might be less than the optimal amount that is required for your environment. Verifying host name configuration Before installing an IBM Financial Crimes Alerts Insight with Watson (FCAI) small deployment, you must verify the short host name, fully qualified host name, and domain name for your servers. You must perform these steps for each of your servers. The host name values are used in the fci-hadoop small.hosts.properties file during the installation. Copyright IBM Corp

16 1. Update the DNS settings or the /etc/hosts file on each server. Each server must have an entry in DNS or have an entry in the /etc/hosts file to allow for the resolution of both the short host name and long host name. To implement the name resolution by using the /etc/hosts file, edit the /etc/hosts file on the server to add the IP address of the server and the fully qualified host name. For example, add the following line to the file: nnn.nnn.nnn.nnn fciserver.example.com fciserver Where, nnn.nnn.nnn.nnn is the IP address of the server fciserver.example.com is the fully qualified domain and host name for the server fciserver is the short name of the server Note: If you are using an /etc/hosts file for name resolution, ensure that files is listed first on the hosts: entry in the Name Service Switch configuration file (/etc/nsswitch.conf file). For example, # cat /etc/nsswitch.conf grep "hosts" hosts: files dns myhostname 2. Log on to the server as root user and open a command prompt. 3. Verify and record the defined short host name for the server by typing the following command: hostname -s The command returns the defined short host name for the server, such as fciserver. 4. Verify and record the fully qualified domain and host name for the server by typing the following command: hostname -f The command returns the fully qualified domain and host name for the server, such as fciserver.example.com. Note: The host names that you enter in the fci-hadoop hosts.properties file is casesensitive and must match the case of the host names that are returned by hostname -f. If the cases do not match, the installation will fail. 5. Verify and record the domain name for the server by typing the following command: hostname -d The command returns the domain name for the server, such as example.com. Validating Linux umask settings Before you install an IBM Financial Crimes Alerts Insight with Watson (FCAI) small deployment, you must validate that the umask value is set to 0022 on all servers. Important: If the umask setting is 022, even though it is equivalent to 0022, the installation will fail. The value must be set to 0022 during the installation. IBM FCAI contains several components, which require a umask value of 0022 during installation. IBM FCAI must also be installed using the root user ID. This combination (umask value and user ID) is the default setting for many Linux distributions. However, a local system administrator might change the default umask value. You must ensure that the umask for the root account and all newly created users is set to the system default of 0022 on all servers during the IBM FCAI installation. After installation is completed, you can modify the umask value as required. 6 IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

17 Important: Setting restrictive umask values greater than 022 (for example, 077) can result in runtime errors. 1. Open a terminal window and log in as the root user, or enter sudo su root to become root. If logged in as another user, enter sudo su root -c umask. 2. For new users only, enter the following command to create a test user: useradd -m -U testumask Then, create a new login shell to become the new user: su - testumask 3. From the terminal prompt, enter the following command: umask 4. If the value returned is not 0022, consult your system administrator to have the default value changed to Return to the root prompt and enter the following command: exit 6. For new users only, delete the test user that you created in Step 2 as follows: userdel -r testumask Verifying server to server connectivity Before you install an IBM Financial Crimes Alerts Insight with Watson (FCAI) small deployment, you must verify that each server can ping associated servers. The following procedure verifies the connectivity to each server from the Ambari server. You must perform these steps as the root user. 1. Verify that the Ambari server can connect to the other servers by running the following commands: ping hadoop-master_server.example.com ping hadoop-slave1_server.example.com 2. Start SSH on each Hadoop server (hadoop-master and hadoop-slave1), if it is not already started, by typing the following command on each server: systemctl start sshd If disabled, enable remote root login and password authentication by completing the following steps: a. Open the /etc/ssh/sshd_config file in a text editor. b. Find the lines that contain PermitRootLogin and PasswordAuthentication and ensure that both values are set to yes. c. Save the file. d. Run the following command to restart the SSH service: systemctl restart sshd Important: You must repeat this step on each of the Hadoop nodes: hadoop-master and hadoopslave1. Install a small deployment of IBM Financial Crimes Alerts Insight 7

18 3. Verify that the root user can log in to each server via SSH from the Ambari server. While you are logged in to a Terminal session to the IBM FCAI node server, verify that the root user can log in to the hadoop servers via SSH by typing the following commands: ssh root@hadoop-master_server.example.com ssh root@hadoop-slave1_server.example.com Note: You must be able to log in as the root user via SSH for the IBM FCAI and any fix pack installations. Verifying the key fingerprints for each server Each computer on which you install an IBM Financial Crimes Alerts Insight with Watson (FCAI) component in a small deployment must have a unique ECDSA key fingerprint. For example, if you are using cloned servers where the key might be the same on several servers, the installation can fail. You must ensure that the keys on each server are unique. 1. From any server, run the following commands to verify the ECDSA key fingerprints for each server: ssh-keyscan <ambari> ssh-keyscan <hadoop.master> ssh-keyscan <hadoop.slave1> The results should show a unique ECDSA key fingerprint for each server. If the results are not unique, you must regenerate the duplicated key fingerprints. 2. If required, generate new ECDSA key fingerprints: a) Log on to the server as the root user. b) Run the following commands: systemctl stop sshd /bin/rm -f /etc/ssh/ssh_host_* /usr/bin/ssh-keygen -f /etc/ssh/ssh_host_key -b N '' -t rsa1 /usr/bin/ssh-keygen -f /etc/ssh/ssh_host_rsa_key -b N '' -t rsa /usr/bin/ssh-keygen -f /etc/ssh/ssh_host_dsa_key -b N '' -t dsa systemctl start sshd c) After you change the ECDSA key fingerprint, you might have to refresh the key fingerprints to be able to log on to the computer. For example, ssh-keygen -R servername Verifying disk space You must verify whether you have enough disk space for an IBM Financial Crimes Alerts Insight with Watson (FCAI) small deployment. Each server has different minimum disk space requirements. If the disk size is not equal or greater than the requirements in the following table, you must change the default disk space allocation before you install. 8 IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

19 Table 2: Disk Space Requirements Server Role (node name) Required Minimum Available Disk Space Recommended Minimum Available Disk Space Ambari server, including the /opt and /tmp directories 80 GB 100 GB Ambari server /opt directory 15 GB 15 GB Ambari server /tmp directory 5 GB 5 GB Ambari server /var directory, specifically 8 GB 10 GB /var/logs /var/www /var/lib Hadoop servers (hadoop-master, slave 1) - Ambari cluster members 80 GB 250 GB Perform these steps as the root user on the node server. 1. To display the free disk space on the server, enter the following command: df -h This command lists the mounted points and their available space. If /opt does not have a separate mount point, it is created by the installer and the allocated space comes from the / directory. Note: You can also use the lsblk command to display the allocated disk space and mount points on the server. 2. To determine how individual directories are allocated and if they share the same file system, use the following command: df -h directory_name For example, the df -h /opt command displays the size of the /opt directory, how much space is used, and how space of that is available, and the location where the /opt directory is mounted. You can set the disk allocation during installation, or the disks can be reconfigured to provide the required disk space after the Linux installation and before you install IBM FCAI. Installing PyYAML on the Ambari server You must install PyYAML for an IBM Financial Crimes Alerts Insight with Watson (FCAI) small deployment. You install PyYAML by using yum on the Ambari server. 1. Log on to the Ambari server as the root user. 2. Run the following command to install PyYAML. yum install PyYAML Install a small deployment of IBM Financial Crimes Alerts Insight 9

20 Installing Docker and configuring a Docker registry You must install Docker and set up a Docker Registry for IBM Financial Crimes Alerts Insight with Watson (FCAI). You must install Docker on the Ambari server. 1. Install Docker on the Ambari server. yum install docker For more information about installing Docker, Install Docker ( 2. Go to the /etc/docker directory. 3. Open daemon.json in a text editor, and edit the file to include the following: {"insecure-registries":["hostname.domainname:5000"] } 4. Start Docker: systemctl daemon-reload systemctl start docker 5. On the computer where you installed Docker, but not inside the Docker container, create a directory to hold the Docker registry images. The directory must have 25 GB of disk space. For example, mkdir /docker-repo 6. Run the following command to configure and start the Docker registry for IBM FCAI: docker run -d -p docker_registry_port:docker_registry_port -e REGISTRY_STORAGE_DELETE_ENABLED=true --restart=always --name registry -v docker_repo_path:/var/lib/registry:z registry:2 Where: docker_registry_port is the port number for the Docker registry. The default is docker_repo_path is the path to the directory that you created to hold the Docker registry images. For example, /docker-repo For example: docker run -d -p 5000:5000 -e REGISTRY_STORAGE_DELETE_ENABLED=true -- restart=always --name registry -v /docker-repo:/var/lib/registry:z registry:2 After the command finished, run docker ps to verify that the registry is running. The output shows information for the registry container. Downloading and extracting the small deployment installation files After you prepare your environment for installation, you can download and extract the IBM Financial Crimes Alerts Insight with Watson (FCAI) installation files. For more information about the available downloads, see Downloading IBM Financial Crimes Insight with Watson, Private ( 10 IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

21 1. Download the following eimages: IBM Financial Crimes Insight platform Logging CentOS English IBM Financial Crimes Insight platform Database CentOS English IBM Financial Crimes Alerts Insight with Watson, Private (1 of 2) CentOS English IBM Financial Crimes Alerts Insight with Watson, Private (2 of 2) CentOS English IBM Open Platform for Financial Crimes Insight Platform (1 of 2) CentOS English IBM Open Platform for Financial Crimes Insight Platform (2 of 2) CentOS English 2. Save the downloaded eimages to a temporary directory. For example, create a directory that is named fcai (mkdir -p /fcai) and save the downloaded eimages to this directory. The directory should have at least 10 GB of free disk space. 3. Go to the directory where you downloaded the file. cd /fcai 4. Run the following command to extract the installation files: ls *.tar xargs -L 1 tar -C /fcai -xvf Deploying the IBM FCAI images to the Docker registry in a small deployment You deploy the IBM Financial Crimes Alerts Insight with Watson (FCAI) images to Docker by copying the image files to the Docker registry node and run Docker commands to load the images. You must load Docker images that are extracted from the fci-logging102.tar and fcidatabase102.tar files. fci-logging102.tar contains fci-logsearch102.tar.gz and fcilogvisualization102.tar.gz fci-database102.tar contains fci-memoryds102.tar.gz 1. Log in to the computer where you installed Docker and configured the registry as the root user. 2. Go to the directory where you downloaded fc_alert_insight102_1of2.tar and extract the Docker image files. For example, cd /fcai tar -xvf fc_alert_insight102_1of2.tar 3. Run each of the following commands to load the images into Docker: docker load -i fcai-db image.tar docker load -i fcai-logstash image.tar docker load -i fcai-node image.tar docker load -i fci-logsearch102.tar.gz docker load -i fci-logvisualization102.tar.gz docker load -i fci-memoryds102.tar.gz 4. Tag the IBM FCAI Docker images by running each of the following commands: docker tag ibmcom/fcai-db:1.0.2 $(hostname -f):5000/ibmcom/fcai-db:1.0.2 docker tag ibmcom/fcai-logstash:1.0.2 $(hostname -f):5000/ibmcom/fcailogstash:1.0.2 Install a small deployment of IBM Financial Crimes Alerts Insight 11

22 docker tag ibmcom/fcai-node:1.0.2 $(hostname -f):5000/ibmcom/fcainode:1.0.2 docker tag ibmcom/fci-logsearch:1.0.2 $(hostname -f):5000/ibmcom/fcilogsearch:1.0.2 docker tag ibmcom/fci-logvisualization:1.0.2 $(hostname -f):5000/ibmcom/ fci-logvisualization:1.0.2 docker tag ibmcom/fci-memoryds:1.0.2 $(hostname -f):5000/ibmcom/fcimemoryds: Push the images to the Docker registry by running each of the following commands: docker push $(hostname -f):5000/ibmcom/fcai-db:1.0.2 docker push $(hostname -f):5000/ibmcom/fcai-logstash:1.0.2 docker push $(hostname -f):5000/ibmcom/fcai-node:1.0.2 docker push $(hostname -f):5000/ibmcom/fci-logsearch:1.0.2 docker push $(hostname -f):5000/ibmcom/fci-logvisualization:1.0.2 docker push $(hostname -f):5000/ibmcom/fci-memoryds: Verify that the images were pushed to the Docker registry: curl -f):5000/v2/_catalog python -m json.tool The output should include the following entries: { } "repositories": [ "ibmcom/fcai-db", "ibmcom/fcai-logstash", "ibmcom/fcai-node", "ibmcom/fci-logsearch", "ibmcom/fci-logvisualization", "ibmcom/fci-memoryds" ] 7. Run the following commands: docker rmi ibmcom/fcai-db:1.0.2 docker rmi ibmcom/fcai-logstash:1.0.2 docker rmi ibmcom/fcai-node:1.0.2 docker rmi ibmcom/fci-logsearch:1.0.2 docker rmi ibmcom/fci-logvisualization:1.0.2 docker rmi ibmcom/fci-memoryds:1.0.2 Configuring access in a small deployment Before you can use IBM Financial Crimes Alerts Insight with Watson (FCAI), you must configure access to your environment. User security in a small deployment IBM Financial Crimes Alerts Insight with Watson (FCAI) does not contain a registry of user IDs and passwords. Instead, it relies on a third-party registry. For non-production systems, you can quickly set up a secure (TLS) OpenLDAP server for demonstration or learning purposes. You can either create an OpenLDAP host, such as by using a bare-metal server or a virtual machine, or you can configure an fcienablementpublic/openldap Docker container. To configure the fcienablementpublic/openldap Docker container, do the following steps: 1. Log onto the Ambari server as the root user. 2. Go to the /fcai/fcai-install/deploy directory. 12 IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

23 3. Run the following command to download the script: wget -O fcai-openldap-docker-setup.sh fci-enablement-public/ai/master/openldap/fcai-openldap-docker-setup.sh 4. Add executable permissions for the script: chmod u+x fcai-openldap-docker-setup.sh 5. From the /fcai/fcai-install/deploy directory, run the following script:./fcai-openldap-docker-setup.sh This command creates an OpenLDAP Docker container with the following credentials: Table 3: Default credentials for OpenLDAP User name analyst1 investigator1 supervisor1 admin1 Password aml4u aml4u aml4u aml4u If single-sign on (SSO) is configured for both the case manager and IBM FCAI, you will not see the login screen. IBM FCAI shares a session with the case manager, so you access the solution without having to log in. If SSO is not configured, LDAP is used to authenticate. In this case, when you launch the IBM FCAI user interface, you must log in with your LDAP credentials. When you log in, the solution authenticates you by ensuring that your user ID exists in the third-party user registry and that the provided password of the user ID is correct. IBM FCAI also ensures that you are authorized to access the solution. This is accomplished by verifying the group in which you belong and ensuring that the group is authorized to access the solution. You can configure the groups that are authorized to access IBM FCAI in the /fcai/fcai-install/ deploy/fcai-configmap.yaml file on the Ambari server host. There are four roles: analyst, investigator, supervisor, and admin. Each of these roles is mapped to a group. Modify the name of the group to match groups in your user registry that map to these roles. The node.js server accepts requests over HTTPS only. HTTPS requires a private key and a public certificate. Certificates should be stored in the IBM FCAI directory on the node.js server node. For a production system, you might have to purchase third-party certificates. To install them, copy the certificates to the /fcai/fcai-install/deploy directory on the Ambari server host and re-run the fcai-docker.sh script. Setting up Active Directory for a small deployment To use Active Directory Federation Services with IBM Financial Crimes Alerts Insight with Watson (FCAI), you must configure both Active Directory and IBM FCAI. 1. Open Active Directory. 2. Add a new relying party trust with the following attributes: Display Name: Financial Crimes Alerts Insight with Watson Development Server Relying Party Identifier: Install a small deployment of IBM Financial Crimes Alerts Insight 13

24 Add an endpoint: Endpoint type: SAML Assertion Consumer Binding: Post Trusted URL: 3. Right-click on the new Relying Party Trust and select Edit Claim Rules. 4. Configure the rules to send the values of LDAP attributes as claims. a) On the Edit Rule - LDAP attributes window, set the Claim rule name to LDAP attributes. b) On the Attribute store drop-down list, select Active Directory. c) In the LDAP Attribute column, select -Addresses, Display-Name, User-Principal-Name, and Token-Groups - Unqualified Names. d) In the Outgoing Claim Type column, select Address, Name, UPN, and Group. 5. Configure IBM FCAI: a) On the Ambari server node computer, go to the /fcai/fcai-install/deploy directory. b) Open fcai-configmap.yaml in a text editor. c) Edit the SAML entries to suit your environment: AML_SAML_ENTRY_POINT: " AML_SAML_ISSUER: " AML_SAML_DISABLEREQUESTEDAUTHNCONTEXT: "true" AML_SAML_IDENTIFIERFORMAT: "urn:oasis:names:tc:saml:1.1:nameidformat:unspecified" AML_SAML_PROFILE_NAMEIDPROP: " identity/claims/upn" AML_SAML_PROFILE_ PROP: " identity/claims/ address" AML_SAML_PROFILE_DISPLAYNAMEPROP: " 2005/05/identity/claims/name" AML_SAML_PROFILE_GROUPSPROP: " 6. Configure the Case Manager. The Case Manager that integrates with IBM FCAI must use this URL to redirect users to the IBM FCAI user interface: external_alert_id=<alert_id>. LDAP integration in a small deployment To integrate with an LDAP server, you must configure IBM Financial Crimes Alerts Insight with Watson (FCAI) to connect to the LDAP server. You must also map certain user properties in the LDAP system to the IBM FCAI properties of the user. All configuration is done in the fcai-configmap.yaml file that is on the Ambari server node. To configure IBM FCAI to connect to the LDAP server, edit the values of the following properties. Ensure that you use double quotation marks for the values, as shown in the examples. AML_LDAP_SERVER_URL The LDAP server in which to connect. For example, "ldap://ldap_hostname:389" AML_LDAP_SERVER_BINDDN The LDAP user in which to perform authentication. For example, "cn=root" AML_LDAP_SERVER_BINDCREDENTIALS Password for the AML_LDAP_SERVER_BINDDN value. AML_LDAP_SERVER_SEARCHBASE An LDAP expression that points to the object that contains the users. For example, "o=users, o=example.com" 14 IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

25 AML_LDAP_SERVER_USERNAME_MAPPING The LDAP property that maps to the user name that a user provides when they log in to FCAI. For example, "username" To configure how IBM FCAI maps certain user properties in the LDAP repository, edit the values of the following properties: AML_LDAP_PROFILE_ID The LDAP property that contains the user's ID. AML_LDAP_PROFILE_ The LDAP property that contains the user's address. AML_LDAP_PROFILE_DISPLAYNAME The LDAP property that contains the user's display name. AML_LDAP_PROFILE_GROUPS The LDAP property that contains the groups in which the user belongs. SSO integration in a small deployment IBM Financial Crimes Alerts Insight with Watson (FCAI) can use an existing SSO infrastructure to authenticate and authorize users. IBM FCAI supports the SAML standard for this integration. In this configuration, you must register IBM FCAI as a service provider with your existing identity provider. To integrate with an SSO infrastructure, you must configure IBM FCAI to connect to the identity provider. You must map certain user properties in the identity provider to IBM FCAI properties of the user. All configuration is done in the fcai-configmap.yaml file on the Ambari server node. To configure IBM FCAI to connect to the identity provider, edit the values of the following properties: AML_SAML_ENTRY_POINT The URL to the identity provider entry point. AML_SAML_ISSUER The issuer string to supply to the identity provider. To configure how IBM FCAI maps certain user properties from the identity provider, edit the values of the following properties: AML_SAML_PROFILE_NAMEIDPROP The LDAP property that contains the user's ID. AML_SAML_PROFILE_ PROP The LDAP property that contains the user's address. AML_SAML_PROFILE_DISPLAYNAMEPROP The LDAP property that contains the user's display name. AML_SAML_PROFILE_GROUPSPROP The LDAP property that contains the user's groups. The SSO response from the identity provider is redirected to the correct alert query in IBM FCAI. For example, The user clicks a link to view an alert in IBM FCAI. The URL has the following format: <hostname>:<port>/login/saml?external_alert_id=<alert_id> If the user is already logged in to IBM FCAI, then the user is directed to a URL with the following format: If the user is not logged in to IBM FCAI, then the user is redirected back to the identity provider. After the identity provider authenticates the user, they are directed back to IBM FCAI, which then redirects the user to the following URL: If SSO is not enabled and you do not have an existing IBM FCAI session open, then you must log in to IBM FCAI to view the alert details. Install a small deployment of IBM Financial Crimes Alerts Insight 15

26 Integration with a case manager application in a small deployment IBM Financial Crimes Alerts Insight with Watson (FCAI) can be launched by an alert that is produced by a case manager application. The following configuration changes must be made in the case manager application to support integration with IBM FCAI: In the case manager application, configure the host name and port on which IBM FCAI is running. In the case manager application, provide a link to IBM FCAI when the alert information is displayed. The link to the insight information for the alert in IBM FCAI is in the following form: <aml_hostname>:<aml_port>?external_alert_id=<xxxx> where <xxxx> is the ID of the alert in the case manager application. After successful configuration, users can follow the alert link in the case manager application to view more details of the alert, including how the alert was scored, in IBM FCAI. Customizing the properties for the Docker containers You must modify some configuration files before you can deploy the IBM Financial Crimes Alerts Insight with Watson (FCAI) Docker containers in a small deployment. 1. Go to the temporary directory where you downloaded and extracted the eimages. cd /fcai 2. Extract the FCI platform logging content: tar -xvf fci-logging102.tar 3. Extract the FCI platform database content: tar -xvf fci-database102.tar 4. Extract the FCAI content: tar -xvf fcai-deploy tar 5. Go to the extracted configuration file directory: cd fcai-install/deploy/ 6. Update the <docker_registry_host> value and port number to point to the Docker registry host in each of the following files: fcaidb-rs.yaml fcaies-rs.yaml fcaikb-rs.yaml fcails-rs.yaml fcainodejs-rs.yaml fcai-redis-rs.yaml Tip: You can use the following command to replace <docker_registry_host> with your Docker registry host value in all of the above files: find. -name '*-rs.yaml' -exec sed -i "s/<docker_registry_host>/ your_docker_registry_host/g" {} \; 16 IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

27 Ensure that you use the correct host for your environment, rather than your_docker_registry_host. Managing certificates to connect to other services in a small deployment You must configure certificates to connect to other IBM Financial Crimes Alerts Insight with Watson (FCAI) components. 1. Log in to the computer where you downloaded and extracted the installation files as the root user. 2. If you are using an LDAP server and connecting to it over SSL, copy the LDAP server certificate to the / fcai/fcai-install/deploy directory and name it ldap.crt. 3. If you are connecting to the IBM Financial Crimes Insight with Watson platform for entity resolution, copy the FCI platform application server certificate to the /fcai/fcai-install/deploy directory and name it fci_platform.crt. 4. If you generated a certificate and key to use for the Node.js container, copy those two files to the / fcai/fcai-install/deploy directory. Name the key fcai.pem and name the certificate fcai.crt. 5. If you generated a new keystore for the DB2 database, then extract the certificate from the keystore and copy it to the /fcai/fcai-install/deploy directory and name it db2.crt. For more information about managing the keystore, see GSKCapiCmd Users Guide. 6. If you are using a self-signed certificate for the LDAP server or for the FCI platform application server, go to the /fcai/fcai-install/deploy directory, and open fcai-configmap.yaml in a text editor. a) Add the following line: NODE_TLS_REJECT_UNAUTHORIZED: "0" b) Save and close the file. Deploying the IBM FCAI Docker containers You deploy the IBM Financial Crimes Alerts Insight with Watson (FCAI) Docker containers by using a script and bash shell functions to manage the docker images and containers. 1. Log in to the computer where you installed Docker and configured the registry as the root user. 2. Go to the /fcai/fcai-install/deploy directory. cd /fcai/fcai-install/deploy 3. Source fcai-docker-functions. source./fcai-docker-functions Note: If you source fcai-docker-functions from the root user's shell profile, you can access the fcai-docker function at any time after the installation. 4. Run the following command to deploy the Docker containers:./fcai-docker.sh fcai-docker.sh uses the fcai-docker function to deploy and re-deploy all IBM FCAI Docker containers. You can refer to this script to manage the individual containers as needed. Run fcai-docker to display its usage. Install a small deployment of IBM Financial Crimes Alerts Insight 17

28 5. After the script has completed, verify that the containers are running: docker ps Running the Hadoop installation and configuration packages This task describes how to run the Hadoop installation and configuration packages for an IBM Financial Crimes Alerts Insight with Watson (FCAI) small deployment. 1. Go to the temporary directory where you downloaded and extracted the installation files. For example, cd /fcai 2. Run the following commands to install the IBM FCAI Hadoop packages. rpm -ivh fci-hadoop-install el7.centos.x86_64.rpm rpm -ivh fcai-hadoop-config el7.centos.x86_64.rpm rpm -ivh fci-hadoop-install-media el7.centos.x86_64.rpm The commands extract the packages to the /opt/ibm/fci/install/ directory. Customizing the properties for the Hadoop configuration You must modify some configuration files before you can run the script to configure the Hadoop cluster for an IBM Financial Crimes Alerts Insight with Watson (FCAI) small deployment. You must edit the fci-hadoop small.hosts.properties file and the fcihadoop properties file. 1. Go to the /opt/ibm/fci/install/ directory. 2. Open the fci-hadoop small.hosts.properties file in a text editor. a) Verify the following entries to match the target installation servers: IP address Server name ROOT password fciambari.mycompany.com root_password fcigateway.mycompany.com root_password fcimaster.mycompany.com root_password where: x is the IP address of the server fci*.mycompany.com is the fully qualified domain name of the server fciambari, fcigateway, and fcimaster are the short host names of the server Important: Do not change the server node labels: ambari hadoop.gateway hadoop.master 18 IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

29 b) Save and close the file. 3. Open fci-hadoop properties in a text editor. a) Update the fcai.environment.size value for the size of the environment that you want to install. Enter 3 for a small deployment. b) Update the fcai.database.host and fcai.logstash.host values for your environment. Important: Do not edit any of the property names before the equal sign or the installation will not complete successfully. The fcai.database.pwd value is informational only. Changing it does not change the FCAI DB2 container password. c) Update any other values as required. d) Save and close the file. Creating and configuring the Hadoop cluster for IBM FCAI small deployment You must run scripts to create and configure the IBM Financial Crimes Insight with Watson platform Hadoop cluster for IBM FCAI small deployment. Before you begin 1. Ensure that the IBM Financial Crimes Insight with Watson platform components are installed. For more information about installing the platform components, see Installing the Financial Crimes Insight platform. 2. Ensure that you have configured the installation files. For more information, see Customizing the properties for the Hadoop configuration on page Log in to the computer where you downloaded and extracted the installation files as the root user. 2. Go to the /opt/ibm/fci/install directory. 3. Run the script to create the Hadoop cluster for IBM FCAI:./fci-hadoop create.cluster.sh To specify a log file, run the following command:./fci-hadoop create.cluster.sh 2>&1 tee "createcluster.`date +%F_ %T`.log" The following message is displayed when the preparation script is complete. [INFO][line 893] CREATE CLUSTER COMPLETE - The installation of the Hadoop Cluster has completed successfully 4. Run the script to configure the Hadoop cluster for IBM FCAI:./fcai-hadoop configure.cluster.sh To specify a log file, run the following command:./fcai-hadoop configure.cluster.sh 2>&1 tee "configurecluster.`date +%F_%T`.log" Install a small deployment of IBM Financial Crimes Alerts Insight 19

30 The following message is displayed when the preparation script is complete. [INFO][line 1121] CONFIGURATION COMPLETE - The configuration of the Hadoop Cluster has completed successfully 20 IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide

31 Chapter 3. Install a medium deployment of IBM Financial Crimes Alerts Insight After you have prepared your environment for installation, and ensured all system requirements are met, you are ready to install IBM Financial Crimes Alerts Insight with Watson (FCAI). You can install IBM FCAI along with the IBM Financial Crimes Insight with Watson platform. Or, you can install it separately. If you install it separately, you must still install some of the components from the IBM Financial Crimes Insight with Watson platform. If you are installing IBM FCAI components on a Red Hat operating system without internet connectivity, you must create internal Red Hat repositories. For more information, see Installing IBM Financial Crimes Alerts Insight in an environment without internet connectivity ( uid=swg ). The IBM FCAI installation involves three parts: 1. The first part is to install the IBM Financial Crimes Insight with Watson platform components. For more information about installing the platform components, see Installing the Financial Crimes Insight platform. For more information about the available downloads, see Downloading IBM Financial Crimes Insight with Watson, Private ( 2. The second part is to run a script to configure the Hadoop cluster for the IBM Financial Crimes Alerts Insight components. For more information, see Creating and configuring the Hadoop cluster for IBM FCAI on page The third part is to deploy the IBM FCAI Kubernetes artifacts and Docker images. For more information, see Deploying the IBM FCAI artifacts to Kubernetes on page 38 and Deploying the IBM FCAI images to Docker on page 37. Preparing for installation Before you install IBM Financial Crimes Alerts Insight with Watson (FCAI), you must complete several preinstallation tasks. System requirements Ensure that you meet the minimum system requirements for an IBM Financial Crimes Alerts Insight with Watson (FCAI) medium deployment installation. To review an up-to-date list of environments that are supported by IBM Financial Crimes Alerts Insight with Watson (FCAI), such as supported software and compatible web browsers, see the Software Requirements. Maintenance levels, such as fix packs and service packs, can be applied as they become available. New release versions are not supported unless the IBM FCAI license specifically states support for a new version. RAM requirements verification Ensure that the computers where you plan to install IBM Financial Crimes Alerts Insight with Watson (FCAI) meet the minimum operating system, CPU, RAM, and disk space. To view the minimum operating system, CPU, RAM, and disk space that is required to install IBM FCAI, view the Software Requirements page. The following table provides the required and recommended RAM for running IBM FCAI. Copyright IBM Corp

32 Table 4: Medium deployment RAM requirements Server role (node name) Required minimum RAM Recommended minimum RAM Ambari server (ambari) 24 GB 32 GB Hadoop servers (hadoop-master, hadoopsecondary, hadoop-gateway, hadoop-slave1, hadoop-slave2) 24 GB 32 GB Kubernetes Master 4 GB 4 GB Kubernetes NFS 8 GB 8 GB Kubernetes worker nodes 8 GB 16 GB Note: As the amount of RAM that you might need varies depending on the server load, the recommended RAM amount might be less than the optimal amount that is required for your environment. Verifying host name configuration Before installing IBM Financial Crimes Alerts Insight with Watson (FCAI), verify the short host name, fully qualified host name, and domain name for your servers. Perform these steps for each of your servers. The host name values are used in the fci-hadoop small.hosts.properties or fcihadoop medium.hosts.properties file during the installation. 1. Update the DNS settings or the /etc/hosts file on each server. Each server must have an entry in DNS or have an entry in the /etc/hosts file to allow for the resolution of both the short host name and long host name. To implement the name resolution by using the /etc/hosts file, edit the /etc/hosts file on the server to add the IP address of the server and the fully qualified host name. For example, add the following line to the file: nnn.nnn.nnn.nnn fciserver.example.com fciserver Where, nnn.nnn.nnn.nnn is the IP address of the server fciserver.example.com is the fully qualified domain and host name for the server fciserver is the short name of the server Note: If you are using an /etc/hosts file for name resolution, ensure that files is listed first on the hosts: entry in the Name Service Switch configuration file (/etc/nsswitch.conf file). For example, # cat /etc/nsswitch.conf grep "hosts" hosts: files dns myhostname 2. Log on to the server as root user and open a command prompt. 3. Verify and record the defined short host name for the server by typing the following command: hostname -s The command returns the defined short host name for the server, such as fciserver. 4. Verify and record the fully qualified domain and host name for the server by typing the following command: hostname -f 22 IBM Financial Crimes Alerts Insight with Watson Version : Solution Guide