Overview

Omny Studio's 'unusual download detection' service can notify you of unusual download behaviour by sending an alert when the amount of downloads, user-agents or locations associated with a single episode in a member's feed exceeds the allowable threshold. Because it's unlikely that a single member would need to download the same episode multiple times or from different locations, this alert could indicate that the member has shared their member-specific feed with others and access to their feed may need to be revoked or paused as a result.

By default, the following thresholds are set:

"DownloadCount": 4,

"UniqueLocationCount": 3,

"UniqueUserAgentCount": 3,

If any of the thresholds are exceeded, a notification will be sent once identified. The process for identifying unusual download activity occurs roughly every 8 hours so there will likely be a delay between the activity occurring and the notification being sent.

You can customise the thresholds for a program, network or your whole organization in the Omny Studio UI here:

Threshold Exceeded Notification

Email notification - you can be notified of unusual download activity to a nominated email of your choice for each program, network or the whole organization where the notification has been triggered. Contact Omny Studio staff to configure your notification email address.

Webhook notification - Once you have configured the Restricted access unusual download activity detected webhook event for your webhook endpoint you will get a webhook event (1 http request) for each member that Omny Studio has detected unusual downloads for.

The event will contain one or more clips where Omny Studio has detected a threshold having been exceeded, along with the counts of downloads, locations and user agents that triggered this classification. The webhook event will be structured like the following example:

 {
  "Type": "RestrictedAccessUnusualDownloadActivityDetected",
  "Timestamp": "2021-03-02T03:41:46Z",
  "EventId": "859570af-ed8c-4790-81e9-acdf003cf446",
  "ChangeId": "2f4562d6-2fc0-4cf1-9e36-4f36922043d6",
  "Current": {
    "Details": [
      {
        "ClipId": "XXXXXX-de7c-414b-8cd0-ac1d0041f96f",
	"ProgramId": "35609e9c-XXXX-4940-979e-a9aa8cc36582",
        "MemberId": "6f71f903-XXXX-4a70-a346-abe40039460d",
        "MemberExternalId": "ex-id-1234",
        "UniqueLocationCount": 5,
        "UniqueUserAgentCount": 3,
        "DownloadCount": 20,
        "OrganizationId": "XXXX-2e1c-4c36-822f-abde00134281"
      },
      {
        "ClipId": "XXXX-60c7-4956-a995-f790ae4be06b",
	"ProgramId": "35609e9c-XXXX-4940-979e-a9aa8cc36582",
        "MemberId": "XXXX-8100-4a70-a346-abe40039460d",
        "MemberExternalId": "ex-id-1234",
        "UniqueLocationCount": 6,
        "UniqueUserAgentCount": 1,
        "DownloadCount": 4,
        "OrganizationId": "XXXX-2e1c-4c36-822f-abde00134281"
      }
    ]
  }
}

UI Notification - in the restricted content access management screen, the member who has been flagged will have a '!' next to their member ID as seen below.

What to do with the notification?

If a member is flagged as having unusual download activity, this won’t stop them from accessing the feed automatically. You can either dismiss the notification, pause the member's access to their feed or delete the member's feed.

You can find the API docs for pausing a member here: https://api.omnystudio.com/api-docs/index#!/ProgramMember/ProgramMember_BulkPauseUnpauseMembers. You can also pause a member's access using the Restricted content access management screen in the UI as seen below:

You can delete a member's feed with the 'program member delete' endpoint in the API https://api.omnystudio.com/api-docs/index#!/ProgramMember/ProgramMember_DeleteMember or via the Restricted content access management UI as seen above.
Once a member is flagged as having unusual download activity, Omny Studio won’t re-notify you about this user until you clear the flag. This can be done either via the API (https://api.omnystudio.com/api-docs/index#!/ProgramMember/ProgramMember_UpdateProgramMember by setting the FlaggedUnusualDownloadActivity:false), or via the Restricted content access management UI (screenshot below)