Overview

Learn how to create and manage Allow and Deny lists in RiskOS™ to apply precise or fuzzy list-based rules within your workflows.

How it works

Allow and Deny lists in RiskOS™ let you define conditions and rules that leverage values from specific lists. They can be used for positive or negative lists, custom watchlists, or other logic that requires list-based evaluations.

With RiskOS™, you can perform:

  • Exact value comparisons: Match an event value precisely against entries in the list.
  • Fuzzy matching: Detect approximate matches (e.g., typos or formatting differences) using trigram-based matching.

Fuzzy matching uses a configurable threshold to balance strictness versus flexibility. For most use cases, we recommend starting with a threshold between 0.8–0.9. Lower thresholds may increase matches but risk false positives, while higher thresholds enforce stricter matching.

This functionality gives you the flexibility to tailor workflow logic to your specific needs.