SAS Social Network Analysis Server 2.3

Transcription

1 SAS Social Network Analysis Server 2.3 Investigator Guide Second Edition SAS Documentation

2 The correct bibliographic citation for this manual is as follows: SAS Institute Inc SAS Social Network Analysis Server 2.3: Investigator Guide, Second Edition. Cary, NC: SAS Institute Inc. SAS Social Network Analysis Server 2.3: Investigator Guide, Second Edition Copyright 2012, SAS Institute Inc., Cary, NC, USA All rights reserved. Produced in the United States of America. For a hardcopy book: No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, or otherwise, without the prior written permission of the publisher, SAS Institute Inc. For a Web download or e-book:your use of this publication shall be governed by the terms established by the vendor at the time you acquire this publication. The scanning, uploading, and distribution of this book via the Internet or any other means without the permission of the publisher is illegal and punishable by law. Please purchase only authorized electronic editions and do not participate in or encourage electronic piracy of copyrighted materials. Your support of others' rights is appreciated. U.S. Government Restricted Rights Notice: Use, duplication, or disclosure of this software and related documentation by the U.S. government is subject to the Agreement with SAS Institute and the restrictions set forth in FAR Commercial Computer Software-Restricted Rights (June 1987). SAS Institute Inc., SAS Campus Drive, Cary, North Carolina st electronic book, April 2012 SAS Publishing provides a complete selection of books and electronic products to help customers use SAS software to its fullest potential. For more information about our e-books, e-learning products, CDs, and hard-copy books, visit the SAS Publishing Web site at support.sas.com/publishing or call SAS and all other SAS Institute Inc. product or service names are registered trademarks or trademarks of SAS Institute Inc. in the USA and other countries. indicates USA registration. Other brand and product names are registered trademarks or trademarks of their respective companies.

3 Contents Accessibility Features of the SAS Social Network Analysis Server v Chapter 1 Introduction Solution Overview Purpose of This Document Target Audience Social Network Analysis Terms and Concepts Supported Investigation Methods Related Documents Chapter 2 Investigator Interface Access and Description Functionality Overview Access the SAS Social Network Analysis Investigator Interface Toolbars, Workspaces, and Panels Search and Filter Features Chapter 3 Alert Management and Disposition Alert Investigation Process Overview Search and Filter Alerts Investigate Alerts Comment Alerts Dispose of Alerts Chapter 4 Social Network Analysis Examining and Manipulating the Diagram Exploring and Managing Nodes Index

4 iv Contents

5 v Accessibility Features of the SAS Social Network Analysis Server Overview For information about the accessibility of any of the products mentioned in this document, see the documentation for that product. The SAS Social Network Analysis Server has been tested with assistive technology tools. It includes accessibility and compatibility features that improve the usability of the product for users with disabilities, with exceptions noted below. These features are related to accessibility standards for electronic information technology that were adopted by the U.S. Government under Section 508 of the U.S. Rehabilitation Act of 1973 (2008 draft proposal initiative update). Applications are also tested against Web Content Accessibility Guidelines (WCAG) 2.0, part of the Web Accessibility Initiative (WAI) of the Worldwide Web Consortium (W3C). For detailed information about the accessibility of this product, send to or call SAS Technical Support. Keyboard Shortcuts The following table contains the keyboard shortcuts for the applications. In the user interface, the shortcuts are displayed within parentheses in tooltips and menu labels. Note: Some application-level keyboard shortcuts do not work when you first open an application. When that happens, press Tab to place the focus on the application and then try the keyboard shortcut again. Note: When you use a keyboard shortcut to activate a button, first give the focus to the field or section that the button is associated with before you use the keyboard shortcut. Task Zoom in Zoom out Reset zoom state Keyboard Shortcut Ctrl++ Ctrl+- Ctrl+0

6 vi Accessibility Features of the SAS Social Network Analysis Server Task Navigate to the column headings in a table Sort columns in a table Keyboard Shortcut For a two-dimensional table, first ensure that the table is in focus. Press Ctrl+F8 to move the focus to the column headings and then use the arrow keys to navigate from heading to heading. For a multidimensional table, first ensure that the table is in focus. Press Tab to move the focus to the column headings and then use the arrow keys to navigate from heading to heading. To sort a single column, navigate to the column heading of the column that you want to sort. Press spacebar to sort the column. To sort additional columns, navigate to the column heading of each additional column that you want to sort. Press Ctrl+spacebar. Exceptions to Accessibility Standards These exceptions are known to occur when using the application with Internet Explorer. Accessibility Issue Using JAWS with this application can sometimes cause Internet Explorer to stop responding. Workaround Using JAWS 13 or later might resolve the issue. JAWS cannot read some of the controls in the application, such as images, icons, and buttons. JAWS cannot read the tooltips of items in trees and lists. JAWS refers to table controls as list boxes. The keyboard shortcuts that are used to interact with editable tables can conflict with keyboard shortcuts for JAWS forms mode. When JAWS reports that a control is a list box, keep in mind that it might actually be a table. As a best practice, disable the JAWS virtual PC cursor when you work with tables. Tab to the table and press Insert+Z to disable the JAWS virtual PC cursor. When you finish interacting with the table, press Insert+Z to reenable the JAWS virtual PC cursor. JAWS cannot read two-column property tables.

7 vii Accessibility Issue Workaround JAWS does not correctly read the information in a table: JAWS cannot read the column headings of a table. When table cells are not editable and the focus is in the body of the table, JAWS reads an entire row at a time instead of cell by cell. When the table cells are editable, and focus is in the body of the table, JAWS reads only the first row of the table. If you use the arrow keys to select a cell or row, then JAWS does not read anything. If you press Enter to edit a cell, then JAWS reads the row that contains the edited cell. When you are in a table cell, if you press Home, End, Page Up, or Page Down, the selected cell will change to be one in the first column of the currently displayed columns for the table. You cannot use the Tab key to successfully navigate the cells in a table if the table contains both editable and non-editable cells. If you can tab to the bottom of a table to add a row, then you cannot use the Tab key by itself to exit the table. Use the arrow keys to navigate through the cells of the table. Use arrow keys to navigate to a cell. If the cell is editable, then press Enter to enter edit mode. Edit the cell. Press Esc to exit edit mode. Then, use arrow keys to navigate to the next cell. Press Shift+Tab to navigate to the top of the table and to then exit the table. You cannot use Shift+F10 to open a pop-up menu. You cannot use the keyboard to access the close (x) button that is in the top right corner of a tab. You cannot use the keyboard to change a tab label. The Help menu is activated using the left or right arrow keys; this might not be the expected navigation for a keyboard-only user. The customizable Filter Panel might contain fields that are not navigable with keyboard keys only or that might respond to unexpected keyboard keystrokes. The Expand Panel and Collapse Panel buttons of the Filter Panel are not identified with function or purpose.

8 viii Accessibility Features of the SAS Social Network Analysis Server Accessibility Issue Workaround The Filter text box associated with the filter search feature gives no indication of its function and is not identified by JAWS as an editable field. The social network analysis diagram node structure is not usable by keyboard only. As a result, keyboard-only users might not be able to perform tasks directly associated with the structure and might have less information provided to them than to mouse users. On the social network analysis diagram, when the following buttons are displayed in the toolbar, the buttons are not read by JAWS: Save Network Add Link Maximize Region Show Node Details Show Legend Show Graph Options Re-Group Nodes Collapse Expanded Nodes In the time and scope controller area of the social network analysis diagram, the Cumulative and Marginal buttons are not announced by JAWS. The components in the time and scope controller area of the social network analysis diagram are not properly labeled and, therefore, they are not announced correctly by JAWS. The user is provided with information about function and how to interact with the time slider, but no indication of purpose is provided.

9 1 Chapter 1 Introduction Solution Overview Purpose of This Document Target Audience Social Network Analysis Terms and Concepts Supported Investigation Methods Related Documents Solution Overview The SAS Social Network Analysis Server 2.3 is a flexible solution that is used to help detect fraud and identify predictive behavior that might lead to fraudulent activities. The functionality of the SAS Social Network Analysis Server 2.3 is surfaced through an investigator interface and an administrator interface. Figure 1.1 Solution Functionality Shown by Interface Access SAS FRAUD FRAMEWORK SAS Financial Crimes Monitor (Administrator Interface) Create and configure projects SAS Social Network Analysis Server (Investigator Interface) Manage and dispose of alerts Administrators are responsible for creating projects and setting up alert routing based on specifications provided. Investigators access the investigator interface to manage and dispose of alerts that have been routed to them.

10 2 Chapter 1 Introduction Purpose of This Document This document is the investigator guide for the SAS Social Network Analysis Server 2.3. Note: Each deployment of the SAS Social Network Analysis Server is configured to meet the needs of a specific customer. The information and screens shown in this document are from demonstration projects that SAS developed to show the functionality of the SAS Social Network Analysis Server and are only examples. All options, such as alert status designations, node colors and meanings, and types of charts, are defined and provided in advance by the report that is authored by a business analyst. Report authoring and custom stored processes are discussed in the companion guide, SAS Social Network Analysis Server: Administration Guide. Target Audience The target audience for this document is the investigator. Investigators use the SAS Social Network Analysis Server to review and manage alerts that are generated to help detect or prevent fraud. The social network analysis diagram that is created automatically from the back-end data enables investigators to review associations related to an alert. Using the information in this document, investigators use the SAS Social Network Analysis Server to do the following: drill from entities into detailed reports review the details of an alert perform management and review tasks of the social network analysis diagram, including the following: view, annotate, and rearrange network nodes connect entities with links and add new nodes and links to the social network save modified social network analysis diagrams for later recall and continued management respond appropriately to alerts, including possible referral to case management Social Network Analysis Terms and Concepts Efficient use of the investigator interface of the SAS Social Network Analysis Server relies on knowledge of the terms and concepts associated with alert generation and management. The process of alert creation depends on the evolution of an entity. An entity can be defined as any object (for example, a person, a facility, a claim) or action (for example, a medical procedure, a bank deposit) for which a fraud detection script can be written and executed. The SAS Social Network Analysis Server monitors entities and generates an alert if a trigger condition is detected.

11 Supported Investigation Methods 3 After a trigger condition is detected, the item is displayed in the interface if (a) there are no instructions in the system to have the alert suppressed and (b) there are no other flags to cause the alert not to be displayed. This item is considered an alerted entity. An alerted entity might or might not be an entity upon which a disposition action needs to occur. For example, if a physician prescribes an uncommon medication for a condition that this type of medication is not generally used for, an alert might be generated. This initial alert might be triggered by meeting the criteria of a scripted fraud scenario, but it would not be considered an actionable entity alert, because there are many sanctioned off-label uses for medications that are not areas for concern. As the system continues to receive data, it aggregates alerted entities. If a series of alerted entities reach a predefined alert trigger-level, the system might get additional information about the alerted entity (for example, sixteen instances of orders for offlabel use of uncommon medications prescribed by a single physician in a two-day period) and escalate the alerted entity to an actionable entity alert. In this example, the actionable entity (that is, the entity upon which an investigation would occur) is the physician. In the investigator interface, the actionable entity alert is displayed in the Alerts workspace. The alerted entities are displayed, generally in a Related Alerts tab on the Details workspace, to provide context for the actionable entity alert. The following diagram shows the relationship and evolution of alerts and entities. Display 1.1 Diagram of Entity Analysis through Actionable Entity Stages Data Sou rce Enri ch data Patient Treatment DRG Time/Date Charge Claim Insurance Patient Treatment DRG Charge Who, What, Where, How... Multiple instances of orders for off-label use of uncommon medications prescribed by a single physician in a two-day period Analyze Entities Alert Entitiy Get Entity Info Alert A ctionable Entity It is worth noting that not all alerted entities are escalated to actionable entity alerts, and not all actionable entity alerts have related entity alerts. Supported Investigation Methods Fraud investigations can be conducted from the bottom up or from the top down. In the bottom-up approach, a single entity (such as a claim or an account) is alerted. A social network analysis diagram, composed of nodes, surrounds the entity and is usually one or two links deep. Investigators explore the social network by expanding the linked nodes.

12 4 Chapter 1 Introduction In the top-down approach, no individual entity is necessarily alerted. Instead, the network, being the highest-level entity, is alerted because the associations among multiple entities of various types (such as claims, claimants, and providers) collectively are suspicious. Networks are treated as single entities and are analyzed and displayed in their entirety. Related Documents Other documents related to the SAS Social Network Analysis Server include the following: SAS Social Network Analysis Server: Administration Guide SAS Social Network Analysis Server: Installation and Configuration Guide

13 5 Chapter 2 Investigator Interface Access and Description Functionality Overview Access the SAS Social Network Analysis Investigator Interface Toolbars, Workspaces, and Panels Main Toolbar Alerts Workspace Details Workspace Social Network Analysis Diagram Search and Filter Features Searching versus Filtering Functionality Overview This section provides information about accessing the investigator interface and describes the functionality of the SAS Social Network Analysis Server 2.3 as it applies to the typical investigator s role of managing and disposing of alerts and of interacting with the social network analysis diagram. Even though the investigator user interface for the SAS Social Network Analysis Server is configurable, some of the user interface features are common for most deployments. This section describes the components of the interface. Detailed information for performing tasks can be found in Alert Management and Disposition on page 27 and Social Network Analysis on page 39. In general, an investigator uses the SAS Social Network Analysis Server investigator interface to view alerts and to either dispose of an alert with no action required or to indicate that further investigation is required. In addition, the investigator can access the social network analysis diagram to learn more about the entity relationships and to add nodes, links, and annotations to refine the diagram. The following actions are routinely performed for investigating alerts: Log on. Select an alert series to investigate. Search and filter alerts to identify the alerts of interest. (Optional) If your role has been configured for Print permission, print the displayed alerts. Investigate each alert by performing the following actions:

14 6 Chapter 2 Investigator Interface Access and Description Review the alert details. Review transactions that are related to the alert. Review charts and graphs that provide information about the entity under investigation. Review the social network analysis diagram that shows the alerted entity and related entities and links. Rearrange nodes and links to organize the view in a desired layout. This layout can be saved and later retrieved for further analysis. If they are needed and configured, review and add comments to an alert. If they are needed and configured, add nodes, links, and annotations to a social network analysis diagram. These modifications can be saved and later retrieved for continued review and updates. Dispose of the alert as requiring no additional investigation, or dispose of it and indicate that further investigation is required, such as opening a case. Access the SAS Social Network Analysis Investigator Interface The investigator user interface for the SAS Social Network Analysis Server is a Web application. Contact your SAS administrator for the Web address and specifications for the browser to use. Investigators are granted access based on the user privileges that are controlled through user authorization. Logon selections are fully configurable, based on user requirements. The following display shows an example logon window for the investigator user interface. Display 2.1 SAS Social Network Analysis Server Investigator Logon Window Example

15 Access the SAS Social Network Analysis Investigator Interface 7 Logon windows are customized according to a specific business domain. Investigators might be prompted on logon to access a specific alert series. To log on to the investigator interface, at the logon window: 1. Provide a user name. 2. Provide a password. 3. Click Log On. Upon successful logon, if your user ID is associated with more than one area of alert series investigation, then you are prompted to select a specific alert series. The following display shows a sample prompt. 4. If you are prompted, click the alert series to investigate. The Alerts workspace appears. This workspace, often referred to as the Alerts Report workspace, displays the alerts that you are authorized to view within the specific domain and might display an active Filter Panel along with an Alert Disposition panel. The following display shows a sample Alerts workspace. T I P To exit the application and return to the logon window, select Log Off, located on the right side of the main toolbar. To choose a different alert series, either refresh the browser window or, if available for your instance, click the Switch Analytic Domain button ( click the Print button ( selected alerts. ) in the toolbar. If your role supports printing, then you can ) in the toolbar to generate a printable PDF of all

16 8 Chapter 2 Investigator Interface Access and Description Toolbars, Workspaces, and Panels The interface used by investigators to manage and review alerts is divided into regions that are consistent with the method in which typical tasks are performed. Main Toolbar The main toolbar is found at the top of the screen. It is always visible, but might change to present only those options that can be performed in a specific workspace. Display 2.2 View of a Typical Toolbar A standard set of buttons, representing functions, is included with a base deployment, but the toolbar for your instance can differ considerably from the one pictured above, depending on the features implemented. Alerts Workspace Alerts Panel The view displayed by default when the solution is accessed is the Alerts workspace. When this workspace is not displayed, it can be retrieved by clicking Alerts in the main toolbar. In a typical deployment, the Alerts workspace contains a collapsible Filter Panel, an expandable Alert Disposition panel, and an Alerts (display) panel composed of columns and rows. The alerts displayed (assuming that the display is not filtered) are contingent upon the permissions associated with the credentials of the user that is logged on. Each row represents an alerted actionable entity that requires additional review and subsequent disposal. Note: If you have not been assigned to the Report Viewer role or if the Alert Disposition panel is not enabled for your role in the current alert series, then you will not have the option of selecting more than one alert.

17 Toolbars, Workspaces, and Panels 9 Display 2.3 View of the Alerts Panel on the Alerts Workspace The specific columns that are displayed are dependent upon the system configuration and setup. All aspects of the Alerts panel of the Alerts workspace are configurable. The content displayed in the Alerts workspace varies according to the following: alert series user credentials Alert series content differences can be seen by comparing the following displays. Display 2.4 Domain Example Alerts Workspace for Property and Casualty Insurance Analytic

18 10 Chapter 2 Investigator Interface Access and Description Display 2.5 Example Alerts Workspace for Health Care Analytic Domain The first display shows an example of a property and casualty insurance Alerts workspace, and the second display shows an Alerts workspace example for a health care analytic domain. The Alerts workspace is filtered for the investigator and ordered by rank to present alerts that are most likely to be indicative of fraud at the top of the rows. To manage the view and access alert details: Sort alerts by clicking a column heading. The alerts reorder in ascending or descending order based on the column each time the column heading is clicked. Change the column width by dragging the vertical divider either left or right to increase or decrease the width of the column. Change the order of the columns by dragging a column heading left or right and dropping it into a new position. To view details about an alert, either double-click the alert to access the Details workspace or select the alert and click Alerts from the main menu. A set of rules determines the time-to-live for each actionable entity alert presented. These rules are summarized as follows: All alerts remain displayed until an action is taken. When a user session ends and then resumes, the alerts to which a disposition has been applied remain visible, showing the current status, until and unless the final disposition (for example, Close) is applied. Note: The final disposition status is configurable and is deployment specific. If a second user logs on to an analytic domain after the first user has disposed of alerts, the second user sees the alerts, and their current status, excluding any alerts that the first user set to the final disposition state. The final disposition status is configurable and is deployment specific. After an alert has been disposed of (that is, reached the final disposition stage), generally it cannot be recalled to the Alerts workspace through the interface.

19 Toolbars, Workspaces, and Panels 11 If a case management system is used, alerts that have been escalated for case management can be accessed through the case management system. Filter Panel If the Filter Panel is available in your deployment, it is generally expanded by default and is displayed to the left of the Alerts panel. The Filter Panel content is unique to each deployed instance and might or might not contain active filters. Display 2.6 View of Filter Panel on the Alerts Workspace Select an item in the Filter Panel to reduce the number of alerts that appear in the Alerts panel. In the following display, for example, only the alerts that have an Alert Type value of Patient are shown. Display 2.7 Filtered Alerts Example The Filter Panel can be collapsed by clicking the Collapse Panel button ( top of the panel. ) at the

20 12 Chapter 2 Investigator Interface Access and Description The filter criteria are configurable and are controlled by subject matter experts in the business domain of interest. Alert Disposition Panel The Alert Disposition panel (which might be named differently in your deployment) is displayed to the right of the Alerts panel by default and is generally not expanded automatically. If your role is not authorized to dispose of alerts, you might not have access to the Alert Disposition panel. Note: At least one alert must be selected to enable the Alert Disposition panel to provide context-specific content. Otherwise, the Alert Disposition panel might be empty. Display 2.8 View of Alert Disposition Panel on the Alerts Workspace The Alert Disposition panel can be expanded by clicking the Expand Panel button ( ) at the top of the panel. Details Workspace Overview The Details workspace is specific to a selected alert. This workspace is configurable and might be displayed much differently in your interface. The standard Details workspace is divided into three sections, with each section having one or more tabbed panels available for access.

21 Toolbars, Workspaces, and Panels 13 Display 2.9 View of Typical Panels Available at the Details Workspace The panels shown in the preceding figure, each completely configurable, are described as follows: Panel Description A. Details panel Can contain detailed information about the actionable entity alert or about the selected alerted entity that is generally viewable in the Related Alerts area (not shown in the preceding display). The content of the Details panel is configurable and might contain links to other information (such as Google maps). For additional information about the Details Panel, see Details Panel on page 14. B. Entity Profile panel Typically shows graphs and graphics related to an alerted entity or an actionable entity and might contain additional tabs to help explain the information collected about the entity. In general, information that can be considered profile information can be found in this area. For additional information about the Entity Profile panel, see Entity Profile Panel on page 14. C. Related Information panel The Related Information panel is a typical panel found in this area. Other panels, customized for your deployment, might also be found in this area. In general, information related to the specific alerted entity might be highlighted in this area. For additional information about the Related Information panel, see Related Information Panel on page 15. Note: If your role is configured for Filter Panel and Alert Disposition panel access, these panels will be available from the Details workspace as described in the preceding Alerts workspace section.

22 14 Chapter 2 Investigator Interface Access and Description Details Panel The Details panel is a standard feature, but its content is customizable. For example, depending on how the SAS Social Network Analysis Server is configured, the Details panel can display targeted information about the actionable alert or the selected alerted entity, or it can be blank. If it is populated, it might include hyperlinks to documents, maps, and so on. An example appears in the following display, where the address is a hyperlink to an Internet-based mapping application. Display 2.10 Example Details Panel Information displayed in the Details panel is Read-Only. That is, it cannot be changed through the panel and is updated based on data within the system. Note: The Social Network Analysis tab is a standard tab found in the Details panel. This tab provides access to the social network analysis diagram. The diagram is a graphical representation of the items that make up the social network and their relationships to one another. Social network analysis diagrams are configurable and are different for each instance of the solution deployed. Entity Profile Panel The Entity Profile panel of the Details workspace is configurable and is based on customer requirements. Typically, this panel contains graphs and graphics that all relate to the actionable entity selected from the Alerts workspace. The quantity and types of the graphs, as well as their content, vary according to the selected alert. Investigators cannot add or delete graphs. In addition, tabs in the Entity Profile panel have the following features: Tabs can be reordered within the Entity Profile panel by selecting the tab, dragging the tab to a new location within the section, and releasing the tab. Referring to Display 2.9 on page 13, tabs from the Entity Profile panel (area B) can be dragged to the Related Information panel (area C), and tabs from the Related Information panel can be dragged to the Entity Profile panel. When you drag tabs to a new panel, you cannot relocate the last tab in the originating panel. Graphs can be minimized and maximized using the buttons on the upper right of each graph panel.

23 Toolbars, Workspaces, and Panels 15 Placing the cursor over the bars and lines of a graph reveals the underlying data points. The entire Entity Profile panel can be expanded by selecting the maximize button at the top right of the alert banner. The following display shows the location of the maximize button. Display 2.11 Entity Profile Display Related Information Panel The tabs on the Related Information panel at the bottom of the alert Details workspace show information that is related to the selected alert. That is, the items that are listed are usually the discrete alerted entities that make up the alerted actionable entity displayed at the Alerts workspace. Each row represents an individual scenario that triggered the alert in question. Other tabs, customized for your deployment, might also be found in this area. Most deployments include a tab that is named Related Alerts. The other tabs vary according to the business domain of interest. For example, the Biller Information, Flagged Claims, and Provider Level Violations tabs in area C of Display 2.9 on page 13 are examples from a health care business domain. Related alerts are triggered based on the business rule and predictive models that are run at the various sub-entity levels. In addition, tabs in the Related Information panel have the following features: Tabs can be reordered within the Related Information panel by selecting the tab, dragging the tab to a new location within the panel, and releasing the tab. Referring to Display 2.9 on page 13, tabs from the Related Information panel (area C) can be dragged to the Entity Profile panel (area B), and tabs from the Entity Profile panel can be dragged to the Related Information panel. When you drag tabs to a new panel, you cannot relocate the last tab of the originating panel. Referring to Display 2.9 on page 13, if graphs are relocated from the Entity Profile panel (area B) to the Related Information panel (area C), then the graphs can be minimized and maximized using the buttons on the upper right of each graph panel. Referring to Display 2.9 on page 13, if graphs are relocated from the Entity Profile panel (area B) to the Related Information panel (area C), then placing the cursor over the bars and lines of a graph reveals the underlying data points.

24 16 Chapter 2 Investigator Interface Access and Description Social Network Analysis Diagram Overview of Diagram Features The social network analysis diagram enables you to view and manage the relationships associated with the currently selected alert. The panel is divided into several seamless regions with functionality to enable you to perform all necessary tasks. Display 2.12 Example of a Social Network Analysis Diagram Feature Description A. Social network analysis toolbar B. Nodes, links, and relationships The social network analysis toolbar is configurable for each deployment instance. Your instance might not appear the same as the one in the preceding figure or allow execution of all features described in this document. In general, the toolbar enables you to rearrange the elements in the diagram, group and ungroup nodes, have the system redraw or center the diagram, and add additional nodes and links. For additional information, see Social Network Analysis Diagram Toolbar on page 17. The nodes and entity relationships are viewable in the social network analysis diagram, drawn in the center of the screen. The social network analysis diagram represents the relationship of the entities in the currently selected alert. The look and many of the characteristics of this diagram can be controlled or modified using the toolbar. The icons that represent the diagram are customizable and might not resemble the diagrams displayed in this guide. For additional information, see Nodes, Links, and Relationships on page 17.

25 Toolbars, Workspaces, and Panels 17 Feature C. Time and scope controller Description If your solution is configured for this functionality, the time and scope view can be controlled by using the time slider, the jump-to functionality, and the Cumulative and Marginal buttons found at the bottom of the diagram. Note: For detailed information about the use and advantages of cumulative versus marginal views of the social network analysis diagram, refer to Time and Scope Controller on page 21. Social Network Analysis Diagram Toolbar The social network analysis diagram contains a button toolbar to the left of the diagram. Display 2.13 Example Social Network Analysis Diagram Toolbar The toolbar is customizable and differs for each deployment. The toolbar in your instance might have a different set of buttons, including some not shown in this example diagram. Each button description is shown when you position your mouse pointer over the button. This guide provides additional information, as appropriate, in sections where a toolbar button can be used to execute an operation. Nodes, Links, and Relationships A social network analysis diagram consists of a series of nodes connected by links, where the nodes are entities represented by icons, and the link represents the start and end time of entity involvement. The node icon might represent a single entity (person), a transaction (purchase), or any other relevant item. Nodes might be grouped (either manually or by an optional autogrouping feature). The social network analysis diagram displays the interconnected details of a specific alert. The diagram shows the relationship between a specific entity or group and other related entities or groups. The entity icons are specific to your deployment and might contain representations for items such as patients, doctors, claims, and provider. A group is represented by a square icon containing four small squares inside. Your deployment might be configured to group automatically (autogroup) spur nodes.

26 18 Chapter 2 Investigator Interface Access and Description Spur node autogrouping is a default configuration, but it can be turned off by the administrator during system configuration. Spur node autogrouping occurs when the social network analysis diagram contains lone nodes. These lone nodes are then clustered with the connected node or group. This action happens automatically and recursively, so that no spur nodes or spur groups are displayed in the view. Display 2.14 Example of Spur Node Autogrouping Social Network Analysis Diagram without Autogrouping Social Network Analysis Diagram with Autogrouping With autogrouping enabled for spur nodes, large social network analysis diagrams take less time to render and, often, more of the diagram can be viewed at one time without scrolling or zooming. Group content can be explored or expanded easily to see the details of the included nodes and groups. Social network analysis diagrams are created based on the data that is available during the alert generation process. Investigators do not need to perform any tasks to create and display the social network analysis diagram.

27 Toolbars, Workspaces, and Panels 19 The following figure shows a sample social network diagram (with all groups expanded). Display 2.15 Sample Social Network Analysis Diagram A node ID uniquely identifies a node in a social network analysis diagram. In contrast, a label contains descriptive and meaningful text about a particular node. The text in the label is controlled by subject matter experts in the business domain of interest. Investigators can use the annotation feature to add additional information to selected nodes and groups. Annotations, displayed when you position your mouse pointer over a node, are created and edited directly on the diagram, and basic HTML coding can be used to format the text. Display 2.16 Node ID and Node Annotation New nodes and links can be added to the diagram by using the Add Node feature. Selecting Add Node from a pop-up menu that appears when you position your cursor over a non-grouped node in the social network analysis diagram brings up the Add Node panel. The Add Node panel contains two tabs, Node Properties and Link Properties, and is displayed with required fields populated with default values.

28 20 Chapter 2 Investigator Interface Access and Description Display 2.17 Example of a Typical Add Node Panel Using the Add Node panel, you can add nodes and customize the appearance of the added nodes and links to monitor relationships that might not be indicated in your current data source. Table 2.1 Node Properties for Added Nodes Node Properties Property Description Required? ID A series of characters used to distinguish the node. Assigned by default, but can be changed. Note: A node ID is unique per node. Adding a node and then adding a new node with the same ID but a different change date enables you to specify new parameters for the node, where the new parameters begin at the change date specified. Yes Label Descriptive text for the node. No Tooltip (Annotation) Border Size Color A comment or details for the node. Text can be modified at the social network analysis diagram. Width of the border surrounding the node. The default is selected if border size is not indicated. Background color. The default is selected if a background color is not chosen. No Yes Yes

29 Toolbars, Workspaces, and Panels 21 Node Properties Property Description Required? Border Color Change Date Color surrounding the node. The default is selected if a border color is not chosen. This field is needed only if you are (a) specifying properties for an additional instance of a single node, and (b) one or more node properties change at a specific date, indicated by this change date. Yes Yes (Conditional) Icon A graphical representation of the node entity. Yes Table 2.2 Link Properties for Added Nodes Link Properties Property Description Required? ID To Node From Node A series of characters used to distinguish the link. Assigned by default, but can be changed. Destination of the link. Automatically assigned based on initial selections. This cannot be changed. Origin of the link. Automatically assigned based on initial selections. This cannot be changed. Yes Yes Yes Label Descriptive text for the link. No Thickness Type Width of the link. The default is selected if the link thickness is not indicated. Links can be defined as either a standard link or a vector link. Standard links connect two nodes, while vector links point from one node to another node. Yes Yes Start Date Date upon which the link became active. Yes End Date Date upon which the link grew inactive Yes Color Color of the link. The default is selected if a border color is not chosen. Yes Time and Scope Controller The time and scope controller area of the social network analysis diagram provides a time line that includes a time slider to enable you to view the evolution of the network over time (or at a specific point in time). It also contains scope controls to display either a cumulative or a marginal view, and it contains a jump-to feature to enable you to move rapidly from tick mark to tick mark on the time line.

30 22 Chapter 2 Investigator Interface Access and Description Scope controller Time line Time slider Aug/04/2010 Jun/14/2011 Jump-to feature Table 2.3 Time and Scope Controller Feature Description Feature Description Scope controller Time line Time slider Jump-to feature The Cumulative and Marginal buttons are used to control the scope of the display. Cumulative. Provides functionality to enable viewing the entry of relationships as time progresses. This allows the full graph to be displayed when the time slider is slid all the way to the right. Marginal. Provides functionality to enable viewing the beginning and end of relationships. As the time slider moves to the right on the time line, relationships appear (start time) and disappear (end time) from the graph. The graph might not be fully displayed when the time slider is slid all the way to the right because some relationships (shown as links) could have ended. By default, the graph is displayed with Cumulative selected. The time line represents a period of time and is shown with tick marks that represent the beginning and the ending point of a relationship (link). The time slider can be moved to the left and right on the time line to allow visualization of the network as it develops over time. The jump-to feature enables you to jump right (right arrow) or to jump left (left arrow) to move along the time line at intervals consistent with the tick marks on the time line. The time and scope features enable the investigator to visualize when nodes within the network became active or inactive. As the time slider moves from left to right or from right to left along the time line, nodes can change their transparency to indicate that they became active or inactive (depending on setting the view to marginal or cumulative) at the selected time. Nodes can also change color (or other visual properties) at time intervals. Changes to properties, such as color and transparency, are defined in a toplevel report that is authored by the subject matter expert in the business domain. The investigator can also click anywhere along the time line, causing the slider to snap to the cursor position and show the network diagram at the time indicated at that location. The jump-to feature enables an investigator to click an arrow (left or right) to jump from one time slider tick mark (begin date of a link) to the next tick mark (end date of a link).

31 Search and Filter Features 23 The following figure shows a sample social network analysis diagram with the time slider sitting at the December 23, 2010, tick mark. Several nodes are active in the network at that time. Display 2.18 Time and Scope Controller Example Search and Filter Features To refine the number or type of alerts displayed, the SAS Social Network Analysis Server can provide three methods (advanced search, the Filter Panel, and filter search) for narrowing the scope of the items displayed. Searching versus Filtering Advanced search is an optional feature that enables an investigator to retrieve alerts from the SAS Social Network Analysis Server based on criteria that are controlled by subject

32 24 Chapter 2 Investigator Interface Access and Description matter experts in the business domain of interest. The following display shows a sample Advanced Search panel. Display 2.19 Advanced Search Display Panel The SAS Social Network Analysis Server can be configured so that the Advanced Search panel is displayed automatically when you access the interface, and it can be opened any time the Advanced Search button ( from the toolbar. ) is displayed by clicking the button In deployments that have a high volume of alerts, the initial loading of the alerts in the Alerts workspace can reduce system performance because of the amount of data that must be read from the SAS Social Network Analysis Server, transmitted across the network, and then displayed. The advanced search feature provides a panel that enables you to set criteria for the alerts that you want to view. When the Search Alerts button is clicked in the Advanced Search panel, the criteria are sent from the Web browser to the SAS Social Network Analysis Server. The SAS Social Network Analysis Server uses the search criteria to subset the alerts that meet the criteria and then sends only those alerts to the Web browser and displays them in the Alerts workspace. The Filter Panel operates differently from the advanced search feature. After the Alerts workspace is populated, the Filter Panel can be used to set criteria for the alerts that you want displayed. Alerts that do not meet the criteria are hidden. The criteria are determined in part by subject matter experts who determine whether an alert field should be in the criteria. If so, then check boxes are used for distinct values that are found in the alerts, sliding scales, and text fields. This filtering feature is performed in the Web browser and does not require communication with the SAS Social Network Analysis Server. Refer to Filter Panel on page 11 for additional information. The filter search offers more flexibility for specifying the search or filter term than either of the other two methods.

33 Search and Filter Features 25 Display 2.20 Example of Populated Filter Search Text Area In general, the filter search feature is used to do the following: reduce the number of alerts that are visible in the Alerts workspace. When you type in the Filter text box and click Filter, only the alerts that have a field with matching text or numeric values remain visible. Alerts that do not match the filter expression are hidden. highlight nodes on a social network analysis diagram. When the social network analysis diagram is viewed, you can type text or a numeric string in the Filter text box, and any nodes that match the filter expression are displayed with a blue glow. Regardless of the search or filter type that you use, to clear the criteria and return to an unfiltered view of alerts, you can click the Refresh button ( ). This operation disregards all search and filtering criteria and performs a complete refresh of the alerts in the Alerts workspace by requesting all the available alerts from the SAS Social Network Analysis Server. The following table summarizes the key differences between the search and filter features. Table 2.4 Search and Filter Feature Comparison Characteristic Advanced Search Filter Panel Filter Search Confined to selecting from a predefined set of criteria Yes Yes No Relies on server communication for execution (that is, the process includes a round-trip call to the server resulting in a response that returns matching alerts) Yes No No Can use free form text as the search criteria No No Yes Highlights results on the social network analysis diagram No No Yes Usage information for the search and filter features can be found in Alert Management and Disposition on page 27.

34 26 Chapter 2 Investigator Interface Access and Description

35 27 Chapter 3 Alert Management and Disposition Alert Investigation Process Overview Search and Filter Alerts Search for Alerts with Advanced Search Filter Alerts Investigate Alerts Review the Alert Details Review the Related Information Review the Entity Profile Panel Review the Social Network Analysis Diagram Comment Alerts Comments Feature Overview Adding a Comment to an Alert Adding a Topic to a Node Searching Comments Sorting Comments Dispose of Alerts Alert Investigation Process Overview Although there is no standard procedure that fits every situation for investigating and disposing of alerts, there are several steps that are typical for the process. In general, the process includes the following: Search and filter alerts to locate or group the alerts of interest. Alerts can also be filtered to allow viewing of an alerted entity on the social network analysis diagram. Investigate the alert by performing a series of review steps to determine the factors that generated the alert. If your deployment is configured with the alerts commenting feature, comment or review and update comments as needed to decide the best course of action for the alert. Dispose of alerts as needed and as specified by the policies of your organization. The remaining sections of this chapter discuss each avenue of alert management and disposition. Since each deployment is configured to best suit the needs of the organization, your instance might not be set up to enable you to perform all tasks as described.

36 28 Chapter 3 Alert Management and Disposition Search and Filter Alerts Search for Alerts with Advanced Search If the SAS Social Network Analysis Server is configured with the advanced search feature, then a panel that is similar to the following example might be displayed upon accessing the interface (if the administrator has enabled the initial search feature). This panel enables selection of search criteria so that only the alerts of interest are retrieved from the SAS Social Network Analysis Server. Display 3.1 Advanced Search Panel If the advanced search feature is enabled, then the Advanced Search panel can be opened any time the Advanced Search button ( ) is displayed by clicking the button on the toolbar. Filter Alerts Whether the advanced search feature is enabled or not, after the alerts are retrieved from the SAS Social Network Analysis Server and are displayed, additional features enable you to reduce the number of displayed alerts to only the ones of interest.

37 Search and Filter Alerts 29 The first strategy is to use the Filter Panel that appears to the left of the Alerts panel. The following example shows the Alerts workspace with alerts filtered in the Alerts panel to show those that have an alert type of either Physician or Patient. Display 3.2 Alerts Panel Filtered for Physician and Patient Alert Type The Filter Panel can also be collapsed by clicking the Collapse Panel button ( ). In addition to using the Filter Panel, you can filter alerts by any text string or numeric value by typing in the Filter text box and clicking Filter. The following example shows the Alerts report filtered for the name "Shewchuk." Display 3.3 Alerts Workspace Filter Search Feature The filter search feature enables investigators to filter the contents of the page being displayed. To filter for a character or number string, type the string into the search field and click Filter. The results that pertain to nodes and node IDs in the network are displayed with a blue glow. For an example, see Display 3.5 on page 30.

38 30 Chapter 3 Alert Management and Disposition To clear a filter, click X to the right of the Filter text box. Display 3.4 Filter Search Feature After you have applied a filter for the term "shewchuk" and then double-clicked the alert, the following display highlights the position of Jarret Shewchuk in a social network diagram. Display 3.5 Blue Glow of Filter Results T I P If the item of interest is not highlighted in a blue glow when you access the social network analysis diagram, re-execute the search while at the social network analysis diagram. The entities will then become highlighted as expected.

39 Investigate Alerts 31 Investigate Alerts Review the Alert Details After you double-click an alert in the Alerts panel, the display changes to show the alert details. Display 3.6 Alert Details The information that is provided in the sample display is entirely configurable to meet the needs of the deployment. In the sample display, the Details tab shows a description of the alert, its rank and score, and the charges associated with the alert. Review the Related Information The transactional data that is related to the alert and the alerted entity (a patient, a claim, an account, a physician, and so on) is typically shown in tables in the lower portion of the Details workspace. The number of tabs and the data that is shown depend on the deployment and the type of alerted entity.

40 32 Chapter 3 Alert Management and Disposition Navigate the information by selecting tabs. You can select the vertical separator handle and drag it up or down to increase or reduce the amount of screen that is used to display the transactional data. Display 3.7 Alert Transactions Display and Vertical Separator Handle Review the Entity Profile Panel Depending on the analytics that are performed for identifying suspicious activity, charts and graphics might be displayed to provide more information about the alert and the alerted entity. The following display shows a tab that is labeled Risk details and indicates severities for several risk components. Many tabs can be available in this panel, and a maximize button at the top right section of the panel enables you to increase the size of the Entity Profile panel. Display 3.8 Alert Details Display with Entity Profile Graphics

41 Comment Alerts 33 Review the Social Network Analysis Diagram Click the Social Network Analysis tab to view the entities and relationships that are associated with the alerted entity. In some instances, previously undetected relationships are noticed and the relationships increase the level of suspicion. The following display shows a sample social network. Display 3.9 Social Network Analysis Diagram Example The icons and color that are used in a network diagram are configurable. In this example, the data relationships and analytics on transactional data suggest that three medical equipment providers might have a suspicious relationship, or might even be the same company using three different company names. Comment Alerts Comments Feature Overview If the SAS Social Network Analysis Server is deployed with the SAS Enterprise Business Intelligence Server, then a commenting feature can be enabled by your SAS administrator. The comments feature provides a way for investigators to add comments, search comments, and add attachments to alerts and social network nodes. Adding a Comment to an Alert After selecting an alert to investigate, you can add a comment from the Details workspace. The comment is associated with the entity identifier and the entity type. 1. In the Details workspace, select the Comments tab and then click New Topic.

42 34 Chapter 3 Alert Management and Disposition Display 3.10 Adding a Comment in the Details Workspace The New Topic dialog box appears. 2. Provide a topic name and comment text. Optionally, click the Attachment button to browse for a file to add to the comment. Click Save. Adding a Topic to a Node When the commenting feature is enabled, requesting the node details from the social network analysis diagram provides an opportunity to comment on the node. 1. Select a node from the social network analysis diagram and select Show Details from the node menu. 2. Click New Topic from the Comments tab. Display 3.11 Adding a Comment on the Social Network Analysis Tab The New Topic dialog box appears.

43 Comment Alerts Provide a topic name and comment text. Optionally, click the Attachment button to browse for a file to add to the comment. Click Save. Searching Comments You can search for comments by providing the search term in the Search field and then clicking the Search button ( ). The following display shows the results of searching for the word "narcotic." Click Show This Topic to view the comment that includes the search term, or click Return to Comments to clear the search. Display 3.12 Comments Search Results The search is performed within the comments that are already displayed for the entity or node (as opposed to searching through comments that are for other entities or nodes). It is not possible to use this search feature to search through comments that apply to other entities or other nodes. Sorting Comments Comments are ordered by date that they are added, with the newest comments appearing at the top of the list. This order cannot be changed with sorting.

44 36 Chapter 3 Alert Management and Disposition However, for each comment, you can sort replies to the comment by date and by user. You can also filter the replies so that only the investigator's are shown. Use the Actions menu to choose the sort order. Dispose of Alerts After analyzing the available transactional data, charts, graphics, and social network diagrams, you must take some action on the alert. This action can be to indicate that no further investigation is required, or to assign a status that indicates progress toward taking action against the alerted entity (a person, patient, claim, and so on). Depending on the configuration of your SAS Social Network Analysis Server and the permissions associated with your credentials, you might have an Alert Disposition panel available to enable you to process the alerts. Display 3.13 Setting an Alert to a New Status The availability of the Alert Disposition panel and the list of available states to use for disposing of an alert are configurable. To dispose of an alert, from the Alerts workspace: 1. Select one or more alerts to which a disposition method will be applied. 2. Expand the Alert Disposition panel. Note: The panel is configurable and might have a different name. (For example, it is called the Dispositioning panel in the preceding display.) The panel will also have panes and options that are specific to your deployment. 3. Apply the disposition criteria and methods as appropriate using the Alert Disposition panel. 4. Click Save to execute the disposition method specified by the selections in the Alert Disposition panel. Note: When you click Save, a response code that indicates the current status of the alert is sent to the database. This response code is recognized as the response code consistent with the open pane. So, for example, in the preceding display, the Close response code would be saved with this action.

45 Dispose of Alerts 37 If a column has been defined to show the status of the alert, the alert status changes to indicate the new status. T I P To select all alerts at the same time, click the check box in the header of the check box column. All alerts viewable through the alerts Alerts workspace (for example, including those for which scrolling down would be required to view, but excluding those that have been filtered from the view) become selected.

46 38 Chapter 3 Alert Management and Disposition

47 39 Chapter 4 Social Network Analysis Examining and Manipulating the Diagram Specifying the Social Network Diagram Layout Reviewing the Diagram Controlling the Location, Rotation, and Zoom of the Diagram or Nodes Rearranging the Diagram Nodes Exploring and Managing Nodes Viewing Grouped Node Details Expanding Grouped Nodes Adding New Nodes and Links Linking Existing Nodes Merging Existing Nodes Hiding or Deleting a Node Revealing Hidden Nodes Grouping Nodes Annotating a Node Examining and Manipulating the Diagram The social network analysis diagram is displayed based on a back-end algorithm. This means that the diagram item placement, rotation, layout, and so on, are drawn to the screen in a manner specified by a collection of analytical rules. The items (nodes) of the diagram layout, rotation, and zoom level can be controlled to allow the best view for analysis. When a diagram has been changed, depending on your system configuration and the permissions associated with your user credentials, you might be able to save the diagram by clicking the Save button ( ) from the social network analysis diagram toolbar. If an issue is detected, you will be presented with a warning or error message (for example, conditions that might cause a malformed graph to be committed) when attempting to save. Follow the instruction in the message to resolve the issue. When a social network analysis diagram is saved, it is saved to the alert generation processing database. The network is keyed under the alert information in the current view. Specifying the Social Network Diagram Layout Three possible modes of diagram layout are delivered with the base installation. Depending on the size of your social network analysis diagram, the purpose for the current review, and the length of time the diagram takes to load, you might want to change the layout for your current session.

48 40 Chapter 4 Social Network Analysis Layout Description Example Advanced Shows the entire diagram. If autogrouping is enabled, then spur nodes are folded into groups. Fast Enables you to select the number of graphing iterations to display. Note: This is the default layout option for the social network analysis diagram. Hierarchy Displays the hierarchical relationship of the nodes against the time line of activity. Note: If your data cannot be organized into a hierarchy and you attempt to select this layout, a message indicating that this layout cannot be shown is displayed. If you change a layout, the change applies to the current session and the diagram will return to the default layout when you exit from the session. To change the layout of the current social network analysis diagram, select the Show Graph Options button ( ) from the toolbar and choose the option from the displayed menu. The social network analysis diagram updates to display the new layout. Reviewing the Diagram When the social network analysis diagram is displayed, several features are available to help with diagram review and analysis. The features available are configurable based on parameters specified during setup. All of the features described in this section might not be available in your deployment. Available features enable you to perform the following tasks: maximize the view show the GIS overlay show the diagram legend change the graph option show node details

49 Examining and Manipulating the Diagram 41 The following table describes each of these features. Task Maximize the view Show the GIS overlay Show the diagram legend Toolbar Button Description Maximizes the network viewing pane by hiding the time slider. Click the button a second time to restore the time slider. If configured, presents the social network analysis diagram overlaid on a geographic information system background to enable use of geographic reference. Displays the network icon and colors legend. Change the graph option Show node details Enables you to select from Advanced Layout, Fast Layout, and Hierarchy Layout. Refer to Specifying the Social Network Diagram Layout on page 39 for additional information. Toggles the display of node details in the network diagram. Controlling the Location, Rotation, and Zoom of the Diagram or Nodes Although the nodes of a social network diagram can be managed individually, several features allow the entire diagram to be moved or rotated. During the course of working with the diagram, especially when grouping and ungrouping nodes, the diagram might become off-center or might not be displayed in a way that shows the important features in a focal-point area. Several buttons, if configured, enable you to have the diagram redrawn to reposition the items. Available features enable you to perform the following tasks: center the diagram move the diagram left, right, up, or down rotate the diagram clockwise or counterclockwise zoom in or out to view a specific node or diagram area The toolbar buttons for controlling the location, rotation, and zoom feature of the social network analysis diagram are listed in the following table, along with the keyboard shortcuts, where applicable. T I P To execute keyboard shortcuts, the node has to have keyboard focus, which is implemented differently than mouse focus. To execute keyboard focus, click a node and then use TAB and the arrow keys to navigate the diagram. As long as the keyboard keys are used to navigate the diagram and to select nodes, you will be able to use the shortcut keys described in the following table. The keyboard focus is designated as the dotted blue square around a node.

50 42 Chapter 4 Social Network Analysis Dotted line indicates keyboa rd focus Task Center the diagram Move the diagram Toolbar Button Description Use this control to center the network diagram in the display. Note: HOME is the shortcut key for centering the diagram. The diagram must have keyboard focus before executing the shortcut operation. Click the triangle next to the Center Diagram button to reveal the buttons for moving and rotating the diagram. Revealed by clicking the triangle next to the Center Diagram button, these arrows move the diagram in the indicated directions. Rotate the diagram Zoom in on the diagram Zoom out on the diagram Revealed by clicking the triangle next to the Center Diagram button, these buttons rotate the diagram in the indicated directions. Note: Here are the shortcut keys available for each directional move. The diagram must have keyboard focus before executing the shortcut operation. / (forward slash) key rotates the diagram right.? (question mark) key rotates the diagram left. Zoom in on the diagram. The zoom is executed for each press of the button until maximum size is reached. Click the triangle next to the Zoom In button to reveal the buttons for zooming out on the diagram and for magnifying and shrinking the nodes. Note: The plus key (+) is the shortcut key for zooming in on the diagram. The diagram must have keyboard focus before executing the shortcut operation. Revealed by clicking the triangle next to the Zoom In button, this button zooms out on the diagram. The zoom is executed for each press of the button until minimum size is reached. Note: The minus key ( ) is the shortcut key for zooming out on the diagram. The diagram must have keyboard focus before executing the shortcut operation.

51 Exploring and Managing Nodes 43 Task Magnify and shrink the diagram nodes Toolbar Button Description Revealed by clicking the triangle next to the Zoom In button, these buttons magnify and shrink the nodes. The size increase or decrease is executed for each press of the button until maximum or minimum size is reached. Rearranging the Diagram Nodes Diagram nodes can be moved to allow the best possible experience for viewing and analyzing the displayed information. To move a node (entity or group), drag the node to the new location. Note: The node that is being dragged will rest on top of any nodes that it is dropped onto. So dragging node A to node B, for example, will place node A on top of node B. Dragging node B to node A will place node B on top of node A. The layered placement of nodes when dragging and dropping is not time dependent. This means that regardless of the order of the appearance of the node on the time line, the layers will be built in a drag-from and drag-to order and not according to which node appeared before the other. Exploring and Managing Nodes Nodes can be grouped, and grouped nodes can be expanded. Depending on your deployment, the autogrouping feature for spur nodes might be enabled. Refer to Nodes, Links, and Relationships on page 17 for additional information about autogrouping. Viewing Grouped Node Details Nodes are grouped as the result of either the autogrouping feature (if it is enabled) or as a result of manual grouping. By selecting Show Details from the menu of a grouped node, you can see all items, including annotations, in the group without expanding the group.

52 44 Chapter 4 Social Network Analysis Display 4.1 Grouped Nodes Icon with Show Details Selected To view grouped node details: 1. Position your mouse pointer over the group, and when the is displayed, click it to open the associated menu. 2. From the displayed menu, select Show Details. The Show Details window appears. The Show Details window shows each item included in the selected group. Select an item to view the details associated with the item. Expanding Grouped Nodes Nodes are grouped as the result of either the autogrouping feature (if it is enabled) or as a result of manual grouping. By selecting Expand Group from the menu of a grouped node, you can uncluster the group to view all nodes in context.

53 Exploring and Managing Nodes 45 Display 4.2 Grouped Nodes Icon with Expand Group Selected To ungroup the nodes: 1. Position your mouse pointer over the group, and when the is displayed, click it to open the associated menu. 2. From the displayed menu, select Expand Group. The items in the group are displayed as individual icons and the graph might be redrawn to better display the diagram. T I P To regroup nodes easily, immediately after an Expand Group operation, select the Regroup Nodes button ( ) from the social network analysis diagram toolbar. The nodes that were just ungrouped are regrouped. Adding New Nodes and Links If your role allows, you can add nodes to the social network analysis diagram by invoking the Add Node panel from an icon menu. When adding a node to a social network analysis diagram, you specify the features of the node as well as the features of the link connecting the node to the diagram. This feature also enables you to add an annotation during new node creation or after the node is added to the diagram. To add new nodes and links to a diagram: 1. Position your mouse pointer over the node, and when the is displayed, click it to open the associated menu. 2. From the displayed menu, select Add Node.

54 46 Chapter 4 Social Network Analysis The Add Node panel is displayed, enabling you to specify the node properties as well as the link properties. From the Add Node panel, you can even indicate that a specific node is to change one or more properties on a specific date within the link period. See Table 2.1 on page 20 and Table 2.2 on page 21 for additional information. 3. Specify the parameters for the node and for the link that joins the nodes. 4. After all the parameters have been specified, click OK to continue. The new node and associated link are dropped onto the diagram linked to the originally selected node. Note: If you want to indicate that one or more properties of the node change at a specific time, create another instance of the node by repeating Step 1 through Step 4, making sure you do the following: indicate the same Node ID specify the Change Date update all properties that you want displayed differently beginning with the Change Date 5. At the diagram, drag the new node to your location of choice. T I P If additional links are needed between the new node and existing nodes, use the Draw Link button ( ) to add additional links to other nodes. The types of nodes and specifications for the links are configurable. Therefore, the options available to you for a specific analytic domain might not be the same options available to you if you have access to a different analytic domain. Linking Existing Nodes When reviewing a social network analysis diagram, you might notice a potential connection that is not automatically linked by the solution. You can add links manually to draw a connection between nodes. To add a link between existing nodes: 1. Select the nodes to which a link will be added and click the Draw Link button ( ) from the social network analysis diagram toolbar. The Add Link panel appears. The Add Link panel is the same panel that is displayed as a tab in the Add Node panel. Refer to Table 2.2 on page 21for additional information. 2. Specify the parameters for the link that joins the nodes. 3. After all the parameters have been specified, click OK to continue. The new link is drawn to the diagram connecting the indicated nodes. Merging Existing Nodes When evaluating a social network analysis diagram, you might notice an instance where two separate nodes are actually indicative of a single entity or whose representation might be more accurate if the nodes were merged. You can merge nodes manually to effect a more accurate depiction of the social network.

55 Exploring and Managing Nodes 47 To merge two or more nodes, select the nodes that you want to merge and click the Merge Nodes button, which you can access by clicking the triangle next to the Group Nodes button ( ) on the social network analysis diagram toolbar. Display 4.3 Example of Merge Node Feature The nodes are merged into a single new node. Hiding or Deleting a Node Occasionally you might want to remove a node from view. Depending on your rights and the solution configuration, you might have access to functionality to enable you to hide a node (conceal it from view ) or remove a node (delete it from the diagram). If you hide a node, you will be able to redisplay it. If you delete a node, it cannot be recovered. Note: A node cannot be hidden if that action would leave the node unlinked from other nodes in the network. In these instances, the Hide option does not perform any action. Note: A node cannot be deleted if that action would leave the node unlinked from other nodes in the network. In these instances, the Delete option does not perform any action. Display 4.4 Node Icon with Hide and Delete Selected To hide or delete a node: 1. Position your mouse pointer over the group, and when the is displayed, click it to open the associated menu. 2. From the displayed menu, do one of the following. a. To hide a node, click Hide. The node is hidden from view in the network diagram. After a node is hidden, any node connected to the hidden node displays a plus sign. Selecting any of the plus signs unhides the node. T I P To use the keyboard to invoke this functionality, use a period (.) to hide an icon, and use the greater-than sign (>) to unhide an icon.

56 48 Chapter 4 Social Network Analysis b. To delete a node, click Delete. The node and its associated links are permanently removed from the network diagram. Revealing Hidden Nodes During analysis of a network diagram, it is sometimes helpful to hide nodes. When a node is hidden, the attached node displays a plus sign at the bottom of the node to indicate that there is information that is not displayed. Clicking the plus sign unhides nodes to reveal their place in the social network analysis diagram. To reveal hidden nodes: 1. Locate a node displaying a plus sign at the bottom. 2. Click the plus sign at the bottom of the node. Hidden nodes and associated links are drawn to the social network analysis diagram. Grouping Nodes To group nodes manually, perform the following steps: 1. Click an item (either a node or a group) that will be included in the group. A border is displayed around the item to indicate that it is successfully selected. 2. Hold down the CTRL key and click each of the remaining items that will be included in the group. Each selected item is displayed with a border surrounding it to indicate that it is selected. T I P To select nodes, you can also click the left mouse button and draw an invisible closed shape around the nodes that you want to include. When you release the left mouse button, those nodes encircled will have a black border to indicate that they are selected. You can use this method in conjunction with the CTRL-click method to add more nodes to the selection. 3. Select the Group Nodes button ( ) to group the nodes into a single icon.

57 Exploring and Managing Nodes 49 Display 4.5 Example Showing a Black Border on Selected Nodes Annotating a Node For nodes that are drawn by the system as well as for nodes that you add to the diagram, annotations can be added to provide additional information about a node. The node annotations will be displayed when you position your mouse pointer over the node. To annotate a node: 1. Position your mouse pointer over a node to display the default annotated text. 2. Either click Annotate or double-click the default annotation text and enter your text to replace the default text. T I P You can include HTML formatting markup and HTML links to images in your annotation. 3. Click anywhere outside of the annotation to save the text with the node.