The not Keyword
The
not keyword enables Falcon to exclude values from the condition of a rule. This is useful if you have a large list of values. Instead of including all values, you could exclude just the values you don’t want to look for in your rule.
Using the not keyword is similar to using the is not equal to phrase or the <> symbol. The values in the first and second expression cannot equal one another in order for the condition to be true.
Example
Bank ABC is looking for airline fraud. The rule must look for transactions from any airline except the following: American, Delta and Continental. The transaction must be more than 250 and occur in Mexico.
if
(
CRTRAN24.merchantCountryCode = "484"
//mexico
and CRTRAN24.transactionAmount > 250
and ( CRTRAN24.mcc >= "3000"
and CRTRAN24.mcc <= "3299" )
//represents all airline mcc codes
and not(CRTRAN24.mcc = ("3001" or "3058" or "3061"))
//represents American, Delta and Continental airlines
)
then
{
TriggerCase(ACCOUNT);
}