---
title: Adding custom predictors
description: Custom predictors allow you to include data not represented by any of the out-of-the-box PingOne Protect predictors.
component: pingone
page_id: pingone:threat_protection_using_pingone_protect:p1_protect_adding_custom_predictors
canonical_url: https://docs.pingidentity.com/pingone/threat_protection_using_pingone_protect/p1_protect_adding_custom_predictors.html
revdate: February 19, 2025
section_ids:
  steps: Steps
  choose-from: Choose from:
---

# Adding custom predictors

Custom predictors allow you to include risk-related data that isn't represented by any of the out-of-the-box risk predictors that PingOne Protect provides.

The data for a custom predictor can be:

* Information that PingOne Protect has, but isn't included in one of the standard predictors, such as the country where the user trying to access the resource is currently located

* External risk-related data that you provide as input, such as information on managed and unmanaged devices from PingFederate

You can define three types of custom risk predictors:

* IP range: Definition of risk levels associated with different IP ranges

* String matching: Definition of risk levels associated with different values of input provided as a string

* Numeric range: Definition of risk levels associated with different values of input provided as a number

Custom predictors are treated like the out-of-the-box predictors in terms of:

* Being able to add them to risk policies

* Viewing data for the predictors in the **Threat Protection Dashboard**

* Inclusion of the data in PingOne Audit logs

You can add a maximum of 15 custom predictors per environment.

## Steps

1. In the PingOne admin console, go to **Threat Protection > Predictors**.

2. To add a new predictor, click the **[icon: plus, set=fa]**icon.

3. For the predictor type, select **Custom**.

4. In the **Display Name** field, enter a name for the predictor.

   The display name is used in the **Threat Protection Dashboard** and policy configuration.

5. In the **Compact Name** field, enter a short name that will be returned in the API response.

   |   |                                                          |
   | - | -------------------------------------------------------- |
   |   | You can't change the compact name after it's been saved. |

6. The **Attribute Mapping** field is used to point to the variable that will contain the data that's being used to determine high, medium, or low risk for the predictor. The field can take any of the following types of data:

   ### Choose from:

   * One of the fields included in the `details` object returned in the API response for risk evaluations, such as `details.country`. In this case, you would enter `${details.country}` in the **Attribute Mapping** field.

   * One of the fields included in the `event` object included in the API request for risk evaluations, such as `event.browser.userAgent`. In this case, you would enter`${event.browser.userAgent}` in the **Attribute Mapping** field.

   * Data that you're providing from an external source. You provide the data by including a new field in the `event` object in the `Create risk evaluation` API request, for example, `event.managedDevice`. In this case, you would enter `${event.managedDevice}` in the **Attribute Mapping** field.

     Learn more about the fields included in the `details` and `event` objects in the Details data model and Event data model tables in the [Risk evaluation section](https://developer.pingidentity.com/pingone-api/protect/risk-evaluations.html) of the PingOne API documentation.

     |   |                                                                                                                                                                                                                                                 |
     | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
     |   | If you defined a flow in DaVinci where custom attributes are provided as input to the risk evaluation, you must add `customAttributes` after `event` in the **AttributeMapping** field. For example, `${event.customAttributes.managedDevice}`. |

7. In the **Fallback Predictor Decision Value** list, select a default risk level to use in case the attribute isn't provided.

8. In the **Risk Level Mapping** section:

   1. Select the type of input that's being provided for the comparison:

      * **Range** for numeric range input

      * **IP Ranges** for IP range input

      * **List Item** for string-matching input

   2. Enter the values that will be considered **Low**, **Medium**, and **High** risk.

      1. For string matching, enter one string in each text field.

      2. Click **Add List Item** if you want to provide more than one string for any of the three risk levels.

         |   |                                                                                                                                                                                                                                                                                                                                                                                                                         |
         | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
         |   | * If a value appears in more than one of the risk categories (**Low**, **Medium**, **High**), the more strict risk category is used for the value.

         * For numeric input, the input is assigned to a specific risk level (**Low**, **Medium**, **High**) if it's greater than or equal to the **Min** value and less than the **Max** value.

         * For a string-matching custom predictor, you can define up to 50 strings. |

9. Click **Save**.