1. Click Access and then go to Rules > Rules.
  2. Click + Add Rule.
  3. In the Name field, enter a unique name. The name can be up to 64 characters long. Special characters and spaces are allowed.
  4. From the Type list, select iovation Device Risk device profiling.
  5. In the Blackbox cookie name prefix field, enter the prefix of the cookies containing the iovation blackbox captured by this rule. The default value is iovation_bb.

    Enter the third-party service to use for fraud checks to iovation.

  6. In the iovation URI hook field, enter the location from which to load the iovation blackbox collection JavaScript. This value can be a relative or absolute URL path, but cannot be a complete URL containing scheme and authority. The default value is /iojs.
    Note: To unconditionally disable the first-party iovation JavaScript, set this value to <Reserved Application Context Root>/iojs, where <Reserved Application Context Root> is the context root of the reserved PingAccess application (/pa by default).
  7. Optional: If additional options need to be configured, click Show Advanced.
    1. In the Blackbox time to live (sec.) field, enter the number of seconds to use the iovation blackbox during a session before refreshing the blackbox device profile. The default value is 300.
    2. Optional: In the iovation subkey field, enter the subkey value supplied to you by iovation.
      Note: This value is used for debugging and troubleshooting purposes.
    3. In the iovation script version field, enter the version of the iovation Device Recognition JavaScript to use. The default value is general5.
    4. Optional: Check the Overwrite existing blackbox checkbox to perform blackbox device profiling with every request to resources using this rule.

      When unchecked, the rule only collects the device profile after the existing blackbox expires. This option is unchecked by default.

  8. Click Save.