Transaction Root Cause
Analysis Agent

Signal 1 (Structured): Rule engine on TRADE table — flags records where |(Price − MktClosePrice) / MktClosePrice| > 0.05 (5% threshold). Fires on Acct10011003 at +12.7%.

Signal 2 (Dynatrace): Dynatrace Davis AI custom alert on tag.priceDelta_pct > 5 in the order-execution service. Span c7e02b3d44fa91c8 carries the tag as metadata. FinBERT extracts entity price_deviation from the span annotation text (confidence 0.97).

Signal 3 (Redshift): Audit log shows rep_r9zz ran SELECT curr_market_price FROM acct_pos WHERE security_type='C' at 12:52:17 — 6 minutes before execution. spaCy temporal NER extracts the 6-minute delta; FinBERT classifies the SQL pattern as pre_trade_recon (0.91).

Correlation: Bayesian fusion of 3 signals. The Redshift query proves the rep knew the market price before submitting at a premium — ruling out pricing feed error. Combined confidence: 96%.

Signal 1 (Structured): CASH table rule: Amount < -500000 AND hour(Timestamp) NOT BETWEEN 7 AND 20 fires on -$4.85M at 01:47. ACCT BAL confirms FundsAvailableAmt → -$4,850,000.

Signal 2 (ELK): SIEM alert on user_agent LIKE 'python%' during off-hours login. BERT-base classifier (fine-tuned on 50K auth log samples) extracts entity automated_access from "non-human UA · off-hours login" text (confidence 0.99). Temporal NER links login at 01:43 to ACH at 01:44 (95-second gap).

Signal 3 (Dynatrace): Custom Davis alert on duration_ms < 1.0 for POST operations. Sub-millisecond HTTP POST is physically impossible for human UI interaction. BERT-base extracts scripted_execution from span annotation (0.98).

Correlation: 4 signals, highest confidence in session (99%). The 3-source corroboration eliminates all benign explanations — off-hours, non-human agent, sub-ms execution, limit breach 870%.

Signal 1 (Structured): CASH table WIRE amount threshold rule. Standalone alert generated but insufficient for HIGH confidence without corroboration.

Signal 2 (ELK — critical): BERT-base NER + IP entity linker — a custom component that maintains a rolling in-session IP entity registry. When the WIRE event on Acct10011005 at 10:02 is ingested, the linker finds src_ip=10.42.7.221 in its registry, already linked to the CSH-002 ACH event on Acct10011003 at 01:47. IP entity 10.42.7.221 is extracted from both ELK events with 100% confidence and resolved to a single "operator session" node in the graph.

Key insight: The IP entity exists exclusively in ELK logs — it is absent from every structured trading table. This cross-account link is only discoverable through NLP entity resolution across log events. No SQL join, no FK relationship, no structured data query could surface it.

Correlation: 3 signals. Two large transactions, two different accounts, 8 hours apart — correlated by a single extracted IP entity. Combined outflow: $9.85M from one automated session.

Signal 1 (Structured): Rule: ACCT POS.SecurityType = 'C' AND ACCT MAINT.AccountType = 1. Annuities (SecurityType=C) must not be held in Type 1 brokerage accounts — a FINRA Rule 2330 violation. CUST ID confirms TradingAuthority=F — full discretionary authority for the rep on this account.

Signal 2 (ELK — FinBERT): The SUITABILITY_OVERRIDE compliance event contains the message: "SecurityType=C placed in AccountType=1 · RiskTolerance NULL · customer age 22". FinBERT — fine-tuned on 15,000 FINRA regulatory filings, Reg BI documents, and suitability case law — classifies this text as suitability_violation with 99% confidence. The model recognises "placed in AccountType=1" as the specific violation phrase from FINRA Rule 2330 training data.

Implementation note: FinBERT is the critical component here. The structured rule flags the data anomaly. FinBERT provides the regulatory classification that elevates it to a confirmed compliance violation requiring mandatory reporting — a distinction a simple rule engine cannot make.

Signals 1–3 (Structured): Three independent fields — HoldersBirthDate=2004-01-15 (age 22), RiskTolerance=NULL, TradingAuthority=F. No single field triggers a HIGH alert individually. A young account is not unusual. A NULL risk tolerance might be a pending update. TradingAuthority=F is legal. They only become a violation pattern in combination.

Signal 4 (ELK — BERT co-occurrence): The ELK compliance event carries all three as a combined message. BERT-base (age/risk vulnerability fine-tune, trained on 8,000 financial exploitation case notes) detects the vulnerable_client_pattern entity — the co-occurrence of young age + NULL risk profile + full rep discretion is a known financial exploitation signature. Confidence: 97%.

Why this matters architecturally: This is a case where structured rules fail by design — the individual fields are each "acceptable." Only NLP co-occurrence detection, trained on exploitation case data, can recognise the combination as a compliance risk. This is the clearest demonstration of why log-based NLP is required alongside structured data rules.

Signal 1 (Structured): FUND table rule: TimeOfOrder > 160000 (16:00:00 NAV cutoff). Flags Acct10011003 sell at 18:47. Standalone flag: possible operational delay, not necessarily a violation.

Signal 2 (ELK — RuleBERT): SIEM LATE_ORDER_FLAG event contains "163 min past NAV cutoff — SEC Rule 22c-1 late-trading risk". RuleBERT — fine-tuned on SEC enforcement actions and no-action letters — recognises "SEC Rule 22c-1" and "NAV cutoff" as a late-trading violation pattern, extracting entity late_trading_flag (confidence 0.96).

Signal 3 (Redshift — Temporal NER): Audit log shows rep_r9zz queried DODGX positions across all 3 accounts at 18:51 — 8 minutes after the after-hours order. Temporal NER extracts the 8-minute post-submission window as a cross-account position verification event; RuleBERT classifies it as cross_account_awareness (0.94) — establishing that the rep knew the coordinated position before placing the order.

Correlation: The late-trade alone is LOW severity. The Redshift evidence of deliberate cross-account position awareness is what prevents this from being dismissed as a simple operational error. Combined evidence: SEC Rule 22c-1 risk + coordination intent.