Exceptions

Exceptions in algorithms are designed to provide flexibility in data selection for calculations. This allows specific values to be excluded or included during algorithm execution. Depending on the algorithm, two types of exceptions are supported: blacklist and whitelist.

Blacklist

A blacklist is used to exclude specific data from algorithm calculations. If a value matches the blacklist conditions, it will be excluded from processing.

The blacklist is supported in various algorithms and allows you to manage exclusions based on:

• UBA object identifiers
• Profiling fields
• Periods

Usage in Different Algorithms

Algorithm	Excludable Elements
Dictionary	UBA object identifiers, profiling fields
Statistics	Only UBA object identifiers
Frequency	UBA object identifiers, profiling fields, time periods
Chronology	UBA object identifiers, profiling fields, time periods

Patterns

For UBA object identifiers and additional fields, you can use patterns with a single * wildcard.

Examples of pattern usage:

• Alex* - all values starting with Alex
• *Garcia - all values ending with Garcia
• * - any value

Whitelist

note

The whitelist is only used in the Dictionary algorithm.

It is used to forcibly include specific data in calculations.

note

Whitelist patterns are only supported for UBA object identifiers.

Index Structure

Both the blacklist and the whitelist use the following index structure:

• _meta.id - record identifier
• _meta.created - record creation date and time
• _meta.updated - last update date and time
• algorithm_id - ID of the algorithm the exception setting applies to
• object_id - array of UBA object identifiers the exceptions apply to
• exclude - array of field-based exclusion conditions, where field is the field name and value is the value to match
• ignored_weekend - flag indicating whether to ignore weekends in calculations
• periods - array of time periods. All records matching the defined periods are excluded from the algorithm's calculations

Each period element uses the format <number><time unit>, where:

• Number - defines the ordinal position on the time axis
• Time Unit - suffix::
  • y - year
  • M - month
  • d - day of the month
  • dw - day of the week
  • h - hour
  • m - minute
  • s - second

Examples of values: 1h — the first hour of the day, 2M — the second month of the year, 15d — the fifteenth day of the month.

Example of a JSON index object

{
    "ignored_weekend": false,
    "_meta": {
      "created": "2025-04-08T12:23:08.927Z",
      "id": "4705d342e4a12262fae710eba12ee8d28df622b9",
      "updated": "2025-04-08T12:23:08.927Z"
    },
    "periods": ["1h","2h","3h","2M","15d"],
    "exclude": [
      {
        "field": "computer_name",
        "value": "Lenovo*"
      }
    ],
    "algorithm_id": "0xGgo5UBPL4WRSl6AKeD",
    "object_id": ["Edward*", EvansJoseph]
  }