A rule that flags every transfer above a fixed amount sounds sensible until it fires hundreds of times a day and your team stops reading alerts. Good monitoring rules score risk instead of shouting about it.

Easy Detect works this way. Your system sends events through the API, rules add points to a risk score, and the total decides whether an event is allowed, reviewed, or blocked.

How It Fits Together

You send events through the API. You build the rules in the dashboard, inside a flow. When an event matches a rule’s conditions, the rule adds its score multiplied by its weight to the event’s total. The total is compared with the flow’s decision bands, which give one of three outcomes: Allow, Review, or Block.

You will need two credentials. Your secret key goes in the Authorization header with no Bearer prefix. Your Ingest key, found in the Easy Detect settings, goes in the key field of the request body. They are different keys.

Step 1: Backfill Your History

This step is optional but useful. Send past events to the backfill endpoint so the models can learn what normal looks like before real-time scoring starts. The body has the same shape as a live event. Backfilled events are used for training and are not scored, so no verdict comes back.

Step 2: Create a Flow

A flow is a reusable set of rules for one kind of event. In the dashboard, go to Easy Detect, then Flows, then + Create Flow. Start from a template or from scratch. Events come in three types: banking, payments, and onboarding, so build the flow that matches the events you will send.

Step 3: Build Your Rules

Open the flow and select Manage Rules to reach the Rule Builder. Each rule has:

• Name and description: What it detects, for example, Velocity Limit.
• Score: Points added when the rule fires.
• Weight: A multiplier on the score.
• Type: Severity of High, Medium, or Low, used for filtering and reporting.
• Conditions: Field, operator, and value tests, grouped with AND or OR.

Build conditions from the fields your events carry, such as amount, channel, and device ID.

Score weak signals low and strong signals high. A new device on its own should add a few points. A new device, a large transfer and a freshly changed phone number together should push the total toward Review or Block. The AI Rule Assistant can also propose rules from a plain-language description.

Step 4: Add Custom Lists

Custom Lists are reusable lists that your rules check against. The types are Countries, Email, Phone Number, IP Address, BVN, NIN, and Others. Add values one at a time or upload a CSV. Because rules reference the list, editing it updates every rule that uses it.

Step 5: Set the Decision Bands

The flow’s Decision Output uses a slider to set where Allow, Review, and Block begin. Start with a wide Review band and tighten it as you learn. Under Settings, then Notifications, add an HTTPS webhook URL and optional emails so your team hears when an event is flagged or blocked.

Save the flow as a Draft, then select Publish to go live.

Step 6: Send Events

Send each event as a POST request to the ingest endpoint, with your secret key in the Authorization header and your Ingest key and event type in the body. The Send Events documentation has the full request format, required fields, example payloads, and error codes. Send every field you have, because more context improves scoring.

The result is delivered to your webhook with the risk score, a decision of Allow, Block or Review, and the behavioural signals that fired.

Step 7: Work the Review Queue

Events sent for review land in Cases. A reviewer sees the transaction, user, and risk indicators, then resolves the case with Review with AI for a recommended decision or by choosing Allow or Block manually and adding a reason.

Tune It and Keep Going

Start with three or four rules. The Events page shows each event’s score, fired rules, and decision, so you can raise the weight of rules that catch fraud and retire the ones that only add noise.

For fintechs and banks looking to monitor transactions in real time, explore Dojah’s transaction monitoring.