1. Navigate to the Aliases Linked Workflow section in the Suspects Workflow.
- Enable users to search for Aliases and link them to the suspect record.
- Configure Spark AI Recommendations. You will be selecting the fields in the Suspects Workflow and the Aliases that Spark AI will use to match the remaining three suspects with their alias.
- For the Suspects Workflow, select (1) Notes, (2) Strategy, and (3) Languages Spoken
- For the Aliases Workflow, select (1) Tactics, (2) Bio, (3) Known for Operating in, and (4) Intelligence Report Excerpts.
- Click Save configuration.
- If you haven’t created a layout already, you may want to create one for Aliases so that the alias is deployed on the front end.
2. Navigate to the Primary Suspects Table Report. For each primary suspect, click into the Suspect Record and navigate to the "Alias" section. Use Spark AI to help you find the alias associated with each suspect. You can review the Spark AI Record Linking Recommendations article on the Help Center to learn more.
Link the alias with the highest match strength. Pull up the Aliases record using the Linked Record Preview Feature – does the Spark AI recommendation make sense?
3. Repeat this for each of the three primary suspects.
4. You will now examine the information you have about the suspects to determine which of the three primary suspects was actually responsible for the data breach. Click on a Suspect Record. You will notice that each suspect record has information on when and where the suspect was last seen, as well as a field indicating the amount of time it would take the suspect to get to Chicago from the location where they were last seen.
5. Navigate to the "Suspect Repository" Step. Create Fields (and labels if appropriate) to determine whether the suspect would have been able to make it to Chicago in time to orchestrate the data breach. For example:
- Suspect: Alanna Mitsopolis
- Last Seen Location: Athens, Greece
- Last Seen Date: April 5th
- Date of Breach: April 6th
- Time Taken to get to Chicago: 2 days
- Could they make it to Chicago in time? No, it would take them 2 days to get to Chicago from Greece, which would not be enough time.
Hint: Review the Date Calculation Fields article on the Help Center
Navigate to the Primary Suspects Table Report. For each primary suspect, click into the Suspect Record and navigate to the "Alias" section.
6. Add the appropriate fields to the Primary Suspects Table Report. You should be able to see that only one of the three primary suspects could have caused the data breach.
7. The final answer needs to be in following format: Suspect Name - Alias - Associates: # of Known Associates. Create a Field in the Suspects Workflow that will generate this output including all of these Fields.
Hint: Review the Text Concatenation Fields article on the Help Center
8. Navigate back to your Clues Record from earlier. Indicate that you are ready to submit the final answer and paste the output of the field you created.
- Tip: You can either add the Field to the "Suspect Repository" Step or add the Field to the Primary Suspects Table Report.
EXTRA CREDIT
The IMF is impressed by your work in catching the rogue agent, and would like your help in monitoring suspects to prevent this from happening in the future. They'd like you to create an IMF Suspects Monitoring Dashboard. Below are some ideas of information that could be helpful. The difficulty of each activity is indicated by the green, yellow, and red circles. You can pick and choose from the list below, or you can get creative and create your own reports and calculations to impress the IMF. Feel free to create additional Fields and populate them with data to generate reports.
Note: In order to complete #5, you will have to complete #2, #3, and #4
1. 🟢 Create Visual Reports! You can create any reports you would like, but here are some ideas.
- Suspects by Last Seen Date
- Suspects by Last Seen Location
2. 🟢 Create a Success Percentage Calculation to calculate the percentage of successful operations. You can also create labels!
3. 🔴 Create a Success Rate Calculation. The Success Rate should have a maximum value of 10 and should weigh the Success Percentage based on the total number of known operations into account. You will be weighing Success Percentages based on a higher number of known operations more than those with fewer known operations (if two suspects have a 100% success rate, you want to give more weight to a score where the number of attempted operations is 10 than where the number of attempted operations is 1).
- Weighting if the number of known attempted operations is under 5: 0.5
- Weighting if the number of known attempted operations is under 10: 0.75
- Weighting if the number of known attempted operations is over 10: 1
4. 🔴 Create a weighted Strength of Associates Score. Similar to the Success Rate calculation above, you want to take into account both the number of associates a suspect has and the average capability of associates. Use the following formula: 3*(%f/35) + 5*(%f/10), where the field inputs are the Number of Known Associates and the Average Capability of Associates respectively.
- 35 is used as the denominator when taking the Number of Known Associates into account because it is the maximum number of known associates in this dataset.
- 10 is used as the denominator when taking the Average Capability of Associates into account because the maximum possible score is 10.
- 3 and 5 are used as weights because the Average Capability of Associates is weighted slightly more than the Number of Known Associates
How would you modify this formula? How would you use the available inputs to create a Strength of Associates Score out of 10? How would you weigh the Number of Known Associates and the Average Capability of Associates?
5. 🟡 Create a Suspect Danger Score. The Danger Score should be an average of (1) the Success Rate (2) the Strength of Associates Score (3) the Combat Score and (4) the Strategy Score.
6. 🟢 Play around with Spark AI’s record linking recommendations.
- Have you used Spark AI’s record linking recommendations in your own environments? If not, are there any areas where you could see yourself using this feature?
- Change the Fields in the Suspects and Aliases Workflows that get compared. Unlink one of your three primary suspects and regenerate recommendations. What changes in the match strength do you see?