WTI PollCat NetLink NLJ-VIP, User Manual

Page: 103 / 266

9-1
9. The Alarm Filters
(Toll Fraud Detection)
The Alarm Filters allow the VIP to monitor call records, and check for signs
of Toll Fraud or other phone abuse. When suspect calls are detected, the
VIP can send an SNMP Trap, contact a local PC via the Console Port, dial
a modem or pager or send an Email or Text Message. The Alarm Filter has
priority over the Data Filter: even if a call is rejected by the Data Filter, it
will still be flagged and stored if it matches an Alarm Clue.
The VIP features two separate Alarm Filters. Each filter has its own format,
variables, and alarm criteria. When two dissimilar PBX units are connected
to the VIP, this provides a separate Alarm Filter for each. Each Alarm Filter
includes a "Format", and one or more "Clues" with associated "Actions".
The Format describes the location of specific data items within each call
record. Alarm Filter Clues define the criteria that determine whether or not
a record will be flagged and counted. "Actions" determine how the VIP
will react when an alarm is generated.
Notes:
• When the VIP is connected to two different types of PBX units, it
is recommended to define a separate Alarm Filter for each PBX.
• An Alarm Filter defined for one PBX may not function with
another type of PBX.
9.1. Common Types of Suspect Phone Activity
The first step in the detection of Toll Fraud, is to determine the type of
calls you wish to monitor. The following types of calls may provide an
indication of potential Toll Fraud:
• Repeated unsuccessful attempts to access voice mail
• After-hours long distance calls
• After-hours calls to your 800 number
• Lengthy international calls
• Calls to countries where you don't normally conduct business
The VIP can also be programmed to monitor calls that can indicate internal
phone abuse. Examples of these types of calls are as follows:
• Calls to your competitor's phone number
• Extensions with exceptionally high call activity
• Calls to "900" numbers
All of these call types will have specific characteristics which can be easily
recognized when the VIP examines PBX call records.