What was the impact of the AI solution?

Enhanced fraud detection capability by anticipating potential fraudsters who have not yet crossed risk score thresholds. Reduced false positives and better prioritized fraud investigations, empowering proactive fraud prevention workflows.

Rank#2,254of 3,107

Source

Splunk Uses Amazon SageMaker to Predict Fraud Risk Scores

Use case typeFraud detectionUpdated Jun 13, 2026

Splunk integrates Amazon SageMaker with its risk score data to predict future fraud risk scores for entities, enabling proactive fraud prevention. The implementation uses a scheduled AWS Lambda function to query aggregated risk scores from Splunk, store the data in Amazon S3 buckets, and then Amazon SageMaker builds machine learning models to forecast risk scores. This approach addresses the challenge of detecting fraudsters near the fraud threshold by predicting risk scores before they exceed the threshold, reducing false positives and helping fraud teams prioritize investigations.

Organization: Splunk
Industry: Tech & Comms
Location: United States
Published: January 2024

Reported outcomes

Strategic outcomes

New product / capabilityPredicted future fraud risk scoresRisk & complianceReduced false positives in fraud detectionBetter decisions & insightBetter prioritized fraud investigationsSpeed & agilityEnabled proactive fraud prevention workflows

Primary read

Use case focus

Showing 2 of 2

1Fraud Detection
2Risk Prediction

Fraud detection requires anticipating entities likely to commit fraud before the risk score crosses a fraud threshold to reduce false positives and avoid alert fatigue.

Use Splunk to aggregate risk score data per entity from rule violations and send this data via an AWS Lambda function to Amazon S3 buckets.
Leverage Amazon SageMaker to build models that predict future risk scores for entities using time series forecasting, enabling early fraud detection on upward risk trends.

Technologies

Amazon SageMaker AWS Lambda Amazon S3

Enhanced fraud detection capability by anticipating potential fraudsters who have not yet crossed risk score thresholds.
Reduced false positives and better prioritized fraud investigations, empowering proactive fraud prevention workflows.

Architecture

Splunk aggregates risk score data which is then accessed by an AWS Lambda function to pull the data and store it in Amazon S3. Amazon SageMaker then uses the S3 data to train and host models that predict future risk scores for fraud detection.

Sources & evidence1

Groundedness: 5/5

Primary source

AI-generated summary. Verify important details with the linked sources before relying on this case.

Explore related AI use cases

Customer evidence