← Support

Useful Datadog Searches

How are Filters used in Kibana searching?

When searching in Datadog, it is necessary to use facets as it will help the search to perform faster and more efficiently.

What can a Datadog search look like?

The search bar within Datadog will search any facets contained within the lower portion of the Event Attributes tab. If you select a facet, it shows in the search bar. Some facets won’t need changing, like service facets. Others, like banno.user.id, need changing in the facet list or by clicking on the facet in the search bar and changing it to the userid that you are searching for. Also, any valuescontained within the message field of the log are searchable within the search bar. Views are saved queries and contain the facets and searchable message fields that are needed. An example of a searchable field is <Amt>10.00</Amt>”.

All views are named starting with Banno Support. An example of a view is Banno Support-Transfers Banks XferAdd and contains the values XferAdd banno.user.id:839d1f10-5a69-410c-a10d-7088f0da881f “<Amt>10.00</Amt>”.

If you want to perform a broader search, you can edit the view. For example, if you want to search for all transfers for a userid, you can delete the Amt information and it won’t affect the saved view. For any elements listed, the following applies:

  • ‘C’-value can be changed
  • ‘R’-value can be removed for a broader search
  • No letter - it is necessary for the search and shouldn’t be removed

If you want to narrow a search, additional fields can be added. You can add a value, like at an amount of 10.00 without quotes around, and it will search for any instance of that amount in the message. If you want a specific instance of that amount, like the example of “<Amt>10.00</Amt>” in transfer view, you will need quotes around it. Between any facets or searchable fields, you only need to add a space. It is implied that an ‘AND’ is between the values.

Quotation marks around pieces of information also forces the search to return calls where instances of those characters, in that sequence, appear. So, doing symxchange interaction should return results where the phrase symxchange interaction occurs.

Useful info:

  • Request is what we send to jX
  • Response is what we receive from jX

Institution Logging

Note: Things only log in Datadog when they fail, or when logging is enabled for the institution). Exceptions to this are transfer transactions.

  1. Check if logging is enabled:
  • For core banks, check the institution page in Fetch Reporting to see if Log Interaction Always is True. The value here is set in the jx_configs server in the connection_config_defaults table under log_interaction_always.
  • For core credit unions, Log Interaction Always does not display in Fetch Reporting. Check in the banno_all server in the institution_symxchange_configs table for log_interaction_always.
  1. Enable logging via the Jabberwocky Health tool and then enter the institution ID. Go under jxchange, and click on toggle logging under ‘actions’ bub internal enable-interaction-logging [inst_id] –env=production. Then force a sync for your user:
  • bub api fetch -u [user_id] –env=production
  • bub api fetch –user-id=c112f7b6-d6fd-44fc-a022-21c96106e5cf –days=120 –env=production
  1. Disable logging via the Jabberwocky Health tool and then enter the institution ID. Go under jxchange, and click on toggle logging under ‘actions’.

Helpful Search Tips

The following is a list of calls the app—being used by banks—makes to the core via JX. A general way to search certain calls does exist. That information is seen immediately below, as it could apply to any of the following calls:

  • Status “warn” or “error” indicates something unsuccessful about the call. These are always logged, but keep in mind calls that do not succeed but give a response that the operation was not able to be performed is not always considered unsuccessful. You can see the number of each type of status within the facet list. If you want to see a certain type of status, click on it and it will be added to the search
  • Including information in the search which isn’t in the request may prevent results from being returned. When several pieces of information are used in a search, each piece acts as a discriminating factor; something that must be present in the results. Too much discrimination forces Datadog to search for results which may not actually exist. Therefore, limiting the search criteria to filters and what is in the request/response is very important! Datadog isn’t Google.
  • Including “jXchange Interaction” in your search returns requests with those words. This is obviously important.
  • For credit unions, including SymXchange Interaction as well as the username for the customer should pull up the necessary information for you to troubleshoot a case.

Search by type of sync

Datadog: message:batchcore* - returns logging captured on a batch sync message:onlinecore* - returns logging captured on a manual sync

Honeycomb:
body contains batchcore - returns logging captured on a batch sync body contains onlinecore - returns logging captured on a manual sync

In nearly all cases, searching your desired criteria along with the onlinerequest ID (found in Fetch Reporting) to have information from the end user’s most recent sync returned will be beneficial, if not necessary. That’s because syncs are the only times certain calls are made. And those calls contain the info you want.

2FA Calls - Old and New Methods

2FA Enrollment

View Name: Banno Support-2FAunsuccesful enrollment
"unsuccessful 2FA enrollment"
banno.user.id:[userid]-C

Honeycomb:
body contains unsuccessful 2FA enrollment
banno.user.id = [userid]

Search for finding the method used for a sent 2FA code Authy/Twilio(phone/text messaging)
View Name: Banno Support-2FASentCode1
Service: oob2fa
banno.user.id:[userid]-C<br> Or add
“AuthyID”

Honeycomb:
service.name = oob2fa
banno.user.id = [userid]

OR

View Name: Banno Support-2FASentCode2
“SendOOBCode”
Banno.user.id:[userid]-C

Honeycomb:
body contains SendOOBCode
banno.user.id = [userid]

View Name: Banno Support-2FAUnlockUserRequest
Call made via BSL when a user is requested to be unlocked
“UnlockUserRequest”
Service:netteller-bsl-service
banno.user.netteller.id:[NTID]-C

Honeycomb:
body contains UnlockUserRequest
service.name = netteller-bsl-service
banno.user.netteller.id = [NTID]-C

View Name: Bannno Support-2FANew
Call Made for the New phone/text messaging Twilio options
service:node-consumer-login-proxy
banno.user.id:[25cae337-3dee-45ee-b009-ce921994e2aa]-C
InternalApiError - used to remove unnecessary logs

Honeycomb:
service.name = node-consumer-login-proxy
banno.user.id = [userId]-C
body does-not-contain InternalApiError - used to remove unnecessary logs

View Name: Banno Support-2FAratelimted
User locked out of Authy (rate limited)
Service:oob2fa
"Received a 429 (API usage limit exceeded)"
"userId=[userid]-C

Honeycomb:
service.name = oob2fa
body contains Received a 429 (API usage limit exceeded)
body contains userId=[userid]-C

View Name: Banno Support-Automatic Time Not Set
“InvalidTOTPCode”
banno.user.id:[03bc3865-41c6-43a6-8356-ed1d0a0e39ce]-C

Honeycomb:
body contains InvalidTOTPCode
banno.user.id = [03bc3865-41c6-43a6-8356-ed1d0a0e39ce]-C

Rate Limiting by IP Address

View Name: Banno Support-Rate Limiting
Service:node-consumer-login-proxy
banno.institution.id:[INSTITUTION ID]-C
banno.user.name:[username]-C
“RateLimited”

Honeycomb service.name = node-consumer-login-proxy
banno.institution.id = [INSTITUTION ID]-C
banno.user.name = [username]-C
body contains RateLimited

Customer Information

View Name: BannoSupport-IntnetFinInstIdInq
Call to host via jXchange to get NT account entitlements and transfer account entitlements. Note: this call retrieves the Available Balance Codes from host that are used in Banno for CM users (<AcctViewAvlBalCode> or <XferAvlBalCode> and will also return the list of CM user ids attached to the NT ID.
IntnetFinInstIdInq”
banno.user.netteller.id:[600100608998]-C

Honeycomb:
body contains IntnetFinInstIdInq
banno.user.netteller.id = [600100608998]-C

View Name: Banno Support-Authentication Request BSL
Call made via BSL to prevent dormancy. Note: the dormancy prevention call will not have a masked password included in it, Also used to see log in attempts and if the passed or failed and why.
service:netteller-bsl-service
@banno.user.netteller.id:[610300478066]-C

Honeycomb:
service.name = netteller-bsl-service
banno.user.netteller.id = [610300478066]-C

View Name: Banno Support-CustInq
Call to core via jXchange to get customer information (name/address/phone/demographics/etc)
“CustInq”
banno.routing_number:[FI ROUTING NUMBER]-C
"<CustId>XXX9762</CustId>"- User’s masked CIF-C

Honeycomb:
body contains CustInq
banno.routing_number = [FI ROUTING NUMBER]-C
body contains <CustId>XXX9762</CustId> - User’s masked CIF-C

View Name: Banno Support-CustSrch
Call to core via jXchange using the TIN (TaxID) to get the user’s CIF number (CustomerID)
“CustSrch”
banno.routing_number:[051406909]-C
"<TaxId>XXX5955</TaxId>"- masked TIN-C

Honeycomb:
body contains CustSrch
banno.routing_number = [051406909]-C
body contains <TaxId>XXX5955</TaxId>- masked TIN-C

CM User NetTeller Hold Status

View Name: Banno Support-IntnetFinInstIdUsrInq
Call to NetTeller to get the hold status of a CM user. (CashMgmtUsrState=Y/N) tells us if the user is held. Not available for CIF 20/20.
"IntnetFinInstIdUsrInq"
banno.user.netteller.id:[610300396149]-C
"<CashMgmtUsrId>Matthew</CashMgmtUsrId>" - note this is not the username and is the CM ID-C

Honeycomb:
body contains IntnetFinInstIdUsrInq
banno.user.netteller.id = [610300396149]-C
body contains <CashMgmtUsrId>Matthew</CashMgmtUsrId> - note this is not the username and is the CM ID-C

Customer Accounts Information

View Name: Banno Support- AcctInq
Call to core via jXchange to get balances/type/status for each of the accounts returned in the IntnetFinInstIdInq response (separate call for each acount)
“AcctInq”
banno.routing_number:[051406909]-C
“<AcctId>XXX8576</AcctId>”- *masked account number-C*

Honeycomb:
body contains AcctInq
banno.routing_number = [051406909]-C
body contains <AcctId>XXX8576</AcctId> - *masked account number-C*

  • Note: It is possible within your results, multiple accounts have the same last four digits at the FI. You can use the account type of the account you are looking for to help filter this down “[ACCOUNT TYPE]”
    • Example: “<AcctType>D”, ”<AcctType>S”, ”<AcctType>L”)

View Name: Banno Support-AcctHistSrch
Call that is made twice (once for memo posted “Only” and once for hard posted) to core via jXchange to get transactions for each account (separate call for each account)
“AcctHistSrch”
banno.routing_number:[082900432]-C
“<AcctId>XXX6832</AcctId>”-masked account number-C
banno.user.id:[1a4e5820-f5f7-11e9-970f-0242321aae8f]-C,R

Honeycomb:
body contains AcctHistSrch
banno.routing_number = [082900432]-C
body contains <AcctId>XXX6832</AcctId> -masked account number-C
banno.user.id = [1a4e5820-f5f7-11e9-970f-0242321aae8f]-C,R

  • For calls made in core-fetch the user id will be included in the call
  • “<MemoPostInc>Only” - Used if looking for logs of memo posted transaction (logs without this included will be the hard posted transactions) Make sure lines format correctly!!

View Name-Banno Support-AcctSrch
Call made to core via jXchange to return account details, but not as in depth as AcctInq, and it can include multiple accounts. This call is used to get the account relationships for RDC filtering, and for PSCU credit cards. For PSCU cards, AcctType>CC is returned.
“AcctSrch”
banno.routing_number:[082900432]-C
“<CustId>XXX5279</CustId>”- *User’s masked CIF-C*

Honeycomb:
body contains AcctSrch
banno.routing_number = [082900432]-C
body contains <CustId>XXX5279</CustId>- *User’s masked CIF-C*

BSL Transfer Entitlements

Pagenation has been added to larger requests (BSL, AcctInq, billpay, etc..) seen by ‘Page 1/5’ at the beginnning of the log content.

View Name: Banno Support-GetCustomerTransferAccountsRequest
“GetCustomerTransferAccountsRequest”
banno.user.netteller.id:[605200006589]-C

Honeycomb:
body contains GetCustomerTransferAccountsRequest
banno.user.netteller.id = [605200006589]-C

View Name: Banno Support-Cash Management Entitlements
""cashManagementUserId" : "vcb4422""-C
This can be found using the LoginID and searching the core_login_details table in PG Admin
banno.user.netteller.id:[664520002260]-C

Honeycomb:
body contains "cashManagementUserId" : "vcb4422"-C
This can be found using the LoginID and searching the core_login_details table in PG Admin
banno.user.netteller.id = [664520002260]-C

Transfers

View Name: Banno Support-Transfers Bank XferAdd
Call made via jXchange to create transfers
“XferAdd”
banno.user.id:[USER ID]-C
"<Amt>10.00</Amt>"-C,R

Honeycomb:
body contains XferAdd
banno.user.id = [USER ID]-C
body contains <Amt>10.00</Amt> -C,R

  • Additional info in the request to know the type of transfer:
    • “XferType>Xfer” for internal immediate transfer - JHTRAN
    • “XferType>Fut” for future-dated or recurring transfers - core AFT system
    • “XferType>ACH” for external transfers (micro-deposits, immediate, future-dated or recurring) - core ACH Auto Transfer system

View Name: Banno Support-Transfers Bank XferSrch
“XferSrch”
Call to core via jXchange to search for existing transfers for each account (separately)
banno.user.id is [USER ID]-C
"<AcctId>XXX0584</AcctId>"- masked account number-C,R

“<AcctType>[ACCOUNT TYPE]”

Honeycomb:
body contains XferSrch
Call to core via jXchange to search for existing transfers for each account (separately)
banno.user.id = [USER ID]-C
body contains <AcctId>XXX0584</AcctId> - masked account number-C,R

body contains <AcctType>[ACCOUNT TYPE]

Sometimes there will be multiple results and you might need to find the exact account type so this can be used to narrow down your search

  • Example: “<AcctType>D”, ”<AcctType>S”, ”<AcctType>L”)

View Name: Banno Support-Transfers Bank XferMod
Call to core via jXchange to edit or delete an existing transfer
“XferMod”
banno.user.id:[USER ID]-C

Honeycomb:
body contains XferMod
banno.user.id = [USER ID]-C

  • Additional info in the request to know the type of transfer:
    • “XferType>Fut” for future-dated or recurring transfers - core AFT system
    • “XferType>ACH” for external transfers (micro-deposits, immediate, future-dated or recurring) - core ACH Auto Transfer system

Credit Union Transfers

View Name: Banno Support-Transfers CU

  • “SymXchange Interaction”
  • "<TransferAmount>(transfer amount)</TransferAmount>"-C,R
  • “<UserName>(Username)</UserName>”-C

Honeycomb:

  • body contains SymXchange Interaction
  • body contains <TransferAmount>(transfer amount)</TransferAmount> -C,R
  • body contains <UserName>(Username)</UserName> -C

4|Sight Check Images

View Name: Banno Support- ChkImgInq
Call made to 4|Sight via jXchange that is made twice to get check images (Once for front image and once for back image)
“ChkImgInq”
banno.user.id:[644e1f9b-0944-4e4c-b7cc-060421590723]-C

Honeycomb:
body contains ChkImgInq
banno.user.id = [644e1f9b-0944-4e4c-b7cc-060421590723]-C

View Name: Banno Support- TrnSetItemSrch
Call made to 4|Sight via jXchange that uses the masked account number to get deposit set images
“TrnSetItemSrch”
banno.user.id:[a99aa9bf-3f5a-47eb-8482-7740d327a7e5]-C

Honeycomb:
body contains TrnSetItemSrch
banno.user.id = [a99aa9bf-3f5a-47eb-8482-7740d327a7e5]-C

Specific?: Need host image number, which is found in the check image table:

  • Find trans in F.R., get TranID
  • Go to table, search it by TranID to find provider image ID (same as host image number)

4|Sight Documents (Statements)

View Name: Banno Support- ChkImgStmtSrch
Call to 4|sight via jXchange using the CIF, account number, and account type to retrieve a list of all statements for an account
“ChkImgStmtSrch”
banno.user.id:[54805b39-65dd-48e6-9a70-b77269fa7b2c]-C

body contains ChkImgStmtSrch
banno.user.id = [54805b39-65dd-48e6-9a70-b77269fa7b2c]-C

View Name: Banno Support- ChkImgStmtGen
Call to 4|sight via jXchange using the statement ID from the ChkImgStmtSrch response to get a specific statement
"ChkImgStmtGen"
banno.user.id:[b69fd710-9cd0-11e9-8bd7-024263c70e7d]-C
“12345678” - Include the unmasked statement ID if you know which statement ID you are needing the log for.

body contains ChkImgStmtGen
banno.user.id = [b69fd710-9cd0-11e9-8bd7-024263c70e7d]-C
body contains 12345678 - Include the unmasked statement ID if you know which statement ID you are needing the log for.

See all statements associated to an account:
http://documents-4sight.dreamwork.svc.cluster.production-2/users/<User_ID>/documents/accounts/<Account_ID>?startDate=2000-01-01

To download those statements:
http://documents-4sight.dreamwork.svc.cluster.production-2/users/<User_ID>/documents/<Document_ID>

Info-image documents:
http://documents-infoimage.banno.svc.cluster.production-2/infoimage/institutions/<User_ID/documents/accountNumbers/<AccountNumber>/accountTypes/D?startDate=yyyy-mm-dd&endDate=yyyy-mm-dd

Synergy Statements
View Name: Banno Support- DocImgSrch
“DocImgSrch”
banno.user.id:[c8591f70-90ad-4e23-a1fc-a1fb49f77f2e]-C

Honeycomb:
body contains DocImgSrch
banno.user.id = [c8591f70-90ad-4e23-a1fc-a1fb49f77f2e]-C

EPS Remote Deposit

app_name: remote-deposit-capture banno.user.id:[USER ID]-C
GetCustomers

Honeycomb:
app_name = remote-deposit-capture banno.user.id = [USER ID]-C
body contins GetCustomers

Call made to add new remote deposit enrollees app_name: remote-deposit-capture banno.user.id:[USER ID]-C
AddCustomer

Honeycomb:
app_name = remote-deposit-capture banno.user.id = [USER ID]-C
body contains AddCustomer

Call made to add new remote deposit enrollees app_name: remote-deposit-capture banno.user.id:[USER ID]-C
AddAccount

Honeycomb:
app_name = remote-deposit-capture banno.user.id = [USER ID]-C
body contains AddAccount

Call made to edit remote deposit customers app_name: remote-deposit-capture banno.user.id:[USER ID]-C
UpdateCustomer

Honeycomb:
app_name = remote-deposit-capture banno.user.id = [USER ID]-C
body contains UpdateCustomer

Call made to add new remote deposit accounts app_name: remote-deposit-capture banno.user.id:[USER ID]-C
AddAccount

Honeycomb:
app_name = remote-deposit-capture banno.user.id = [USER ID]-C
body contains AddAccount

Call made to get enrolled accounts for a user app_name: remote-deposit-capture banno.user.id:[USER ID]-C
GetAccounts

Honeycomb:
app_name = remote-deposit-capture banno.user.id = [USER ID]-C
body contains GetAccounts

Call made to gather velocity limits from EPS app_name: remote-deposit-capture banno.user.id:[USER ID]-C
GetVelocity

Honeycomb:
app_name = remote-deposit-capture banno.user.id = [USER ID]-C
body contains GetVelocity

Call made to update velocity limits with EPS app_name: remote-deposit-capture banno.user.id:[USER ID]-C
UpdateVelocity

Honeycomb:
app_name = remote-deposit-capture banno.user.id = [USER ID]-C
body contains UpdateVelocity

Call made to gather deposits for a customer app_name: remote-deposit-capture banno.user.id:[USER ID]-C
GetItems

Honeycomb:
app_name = remote-deposit-capture banno.user.id = [USER ID]-C
body contains GetItems

Call EPS to deposit funds for a user app_name: remote-deposit-capture banno.user.id:[USER ID]-C
AddItem

Honeycomb:
app_name = remote-deposit-capture banno.user.id = [USER ID]-C
body contains AddItem

CPS Debit Cards

View Name: Banno Support- EFTCardSrch
Call to core to get a list of passport cards for an account. Note: If the FI has use_customer_id_for_card_search enabled (TRUE) in connection_config_defaults in jx_configs we do not use this operation with the masked account number and will use the masked CIF instead).
“EFTCardSrch”
banno.routing_number:[071102568]-C
“<AcctId>XXX6766</AcctId>”-C
User’s masked account number
or
“XXX1234”-C
User’s masked CIF

Honeycomb:
body contains EFTCardSrch
banno.routing_number = [071102568]-C
body contains <AcctId>XXX6766</AcctId> -C
User’s masked account number
or
body contains XXX1234 -C
User’s masked CIF

View Name: Banno Support- EFTCardInq
Call to core that gets specific details of a Passport debit card
“EFTCardInq”
banno.routing_number:[071102568]-C
"<EFTCardNum>XXX2500</EFTCardNum>"-C
Masked last four of the card

Honeycomb:
body contains EFTCardInq
banno.routing_number = [071102568]-C
body contaains <EFTCardNum>XXX2500</EFTCardNum> -C
Masked last four of the card

View Name: Banno Support- EFTCardMod
Call made to update a card status in host via jXchange. This call is also used for travel notices.
“EFTCardMod”
banno.routing_number:[051904524]-C
"<EFTCardNum>XXX7509</EFTCardNum>"-C
User’s masked card number

Honeycomb:
body contains EFTCardMod
banno.routing_number = [051904524]-C
body contains <EFTCardNum>XXX7509</EFTCardNum> -C
User’s masked card number

Full Service Credit Cards

View Name: Banno Support-FullServiceCrCardAcctInq
Call to PSCU via jX after we get an account with type CC back from AcctSrch. This returns the balance/etc for PSCU accounts (like AcctInq for regular accounts).
"CrCardAcctInq"
banno.routing_number: [FI ROUTING NUMBER]- C
"<CrCardAcctId MaskVal="XXX3173"”
Masked Credit Card Account Number-C

Honeycomb:
body contains CrCardAcctInq
banno.routing_number = [FI ROUTING NUMBER]- C
body contains <CrCardAcctId MaskVal="XXX3173
Masked Credit Card Account Number-C

View Name: Banno Support-FullServiceCrCardTrnHistSrch
Made for PSCU cards after we get an account with type CC back from AcctSrch. This returns the transactions for PSCU accounts (like AcctHistSrch for regular accounts).
"CrCardTrnHistSrch"
banno.routing_number: [FI ROUTING NUMBER]- C
CrCardAcctId MaskVal="XXX3173"”- Masked Credit Card Account Number-C
“6.00"– amount of credit card transaction- C,R

Honeycomb:
body contains CrCardTrnHistSrch
banno.routing_number = [FI ROUTING NUMBER]- C
body contains CrCardAcctId MaskVal="XXX3173"- Masked Credit Card Account Number-C
body contains 6.00 – amount of credit card transaction- C,R

View Name: Banno Support-FullServiceCrCardTrnAdd
Call made to PSCU via jXchange for credit card payments
"CrCardTrnAdd"
banno.user.id: [USER ID]- C
“<Amt>5000.00</Amt>”- C,R

Honeycomb:
body contains CrCardTrnAdd
banno.user.id = [USER ID]- C
body contains <Amt>5000.00</Amt> - C,R

MyCardRules

View Name: Banno Support- CardAlrtSubInq
Operation that retrieves card alert settings from PSCU via jXchange
“CardAlrtSubInq”
banno.user.id:[1fd0c1fe-80e8-4fb1-8650-77f3e3650ba6]-C
The unique Banno user id used in most places.

Honeycomb:
body contains CardAlrtSubInq
banno.user.id = [1fd0c1fe-80e8-4fb1-8650-77f3e3650ba6]-C
The unique Banno user id used in most places.

View Name: Banno Support- CardAlrtSubAdd
Operation that sends first time user creation tp PSCU via jXchange
banno.user.id:[2902d2ee-2664-4ee7-99af-732636ca3a96]-C
The unique Banno user id used in most places.

Honeycomb:
body contains CardAlrtSubAdd
banno.user.id = [1fd0c1fe-80e8-4fb1-8650-77f3e3650ba6]-C
The unique Banno user id used in most places.

View Name: Banno Support-CardAlrtMod
Operation that creates or modifies an alert
“CardAlrtMod”
banno.user.id:[3aace8d1-7a78-4040-9de8-aa82108758ea]-C
The unique Banno user id used in most places.

Honeycomb:
body contains CardAlrtMod
banno.user.id = [1fd0c1fe-80e8-4fb1-8650-77f3e3650ba6]-C
The unique Banno user id used in most places.

View Name: Banno Support-MyCardRules Alerting
MyCardRules Alerting - use this to see if a user was set up properly for alerts.
“Queue-ondot”
banno.user.id:[2561255c-22e0-4408-a35b-bb3d544541d3]-C

Honeycomb:
body contains Queue-ondot
banno.user.id = [2561255c-22e0-4408-a35b-bb3d544541d3]-C

Bill Pay Data Services Guide

For Bill Pay, there is one View named: Banno Support-BillPay

You will need to change the subscriber value and then insert the call type. For example, “BilPaySubInq” for Payee Inquiry. For a few calls there are additional fields noted with an ‘A’. These are specific for that call and should be removed for all other calls. The Data Services Guide takes you to the Bill Pay document to provide further details about Bill Pay and the Datadog calls.

Payee Inquiry (includes enrolled accounts)
“BilPaySubInq”-C
<SubId>12553291</SubId>

Honeycomb:
body contains BilPaySubInq -C
body contains <SubId>12553291</SubId>

Finding Payees
“BilPayPayeeSrch”
“[SubscriberID]”

Honeycomb:
body contains BilPayPayeeSrch -C
body contains <SubId>12553291</SubId>

Payee Details
“bilPayPayeeInq”
“[SubscriberID]” -C
"<PayeeId>11</PayeeId>"-A

Honeycomb:
body contains BilPayPayeeInq -C
body contains <SubId>12553291</SubId> body contains <PayeeId>11</PayeeId>

Edit/Delete Payees
“BilPayPayeeMod”
“[SubscriberID]”-C

Honeycomb:
body contains BilPayPayeeMod -C
body contains <SubId>12553291</SubId>

Add Payee
“BilPayPayeeAdd”
“[SubscriberID]”-C

Honeycomb:
body contains BilPayPayeeAdd -C
body contains <SubId>12553291</SubId>

Finding payments

Posted Payments

“bilPayPmtHistSrch”
“[SubscriberID]”-C
“[amount of payment]”-A

Honeycomb:
body contains BilPayPmtHistSrch -C
body contains <SubId>12553291</SubId> body contains [amount of payment]

“bilPaySchedPmtAdd”
“[SubscriberID]”

Honeycomb:
body contains BilPaySchedPmtAdd -C
body contains <SubId>12553291</SubId>

Inquire on SubscriberID (Is the user enrolled?) “BilPaySubConsmCustInq”
<SubComId>762200003571</SubComId>-A
This is the NTID; also the SubscriberID should be removed.

Honeycomb body contains BilPaySubConsmCustInq
body contains <SubComId>762200003571</SubComId> -A
This is the NTID; also the SubscriberID should be removed.

Scheduled Payments

“BilPaySchedPmtSrch’
“[SubscriberID]”

Honeycomb:
body contains BilPaySchedPmtSrch
body contains <SubId>12553291</SubId>

iPay Enrollment

View Name: Banno Support- BillPaySubAdd
“BilPaySubAdd”
“<InstRtId>043306826</InstRtId>”Routing Number-C
"<EmailAddr>springscove@gmail.com</EmailAddr>"-C

Honeycomb:
body contains BilPaySubAdd
body contains <InstRtId>043306826</InstRtId> Routing Number-C
body contains <EmailAddr>springscove@gmail.com</EmailAddr> -C

Enrollment

View Name: Banno Support-Banno Enroll
"VerifyHostCustomerEnrollmentRequest"
"stillwelljj2002@gmail.com"-Email-C

Honeycomb:
body contains VerifyHostCustomerEnrollmentRequest
body contains stillwelljj2002@gmail.com -Email-C

Change Account Name

View Name: Banno Support-Change Account Name
Service:netteller-bsl-service
"UpdateAccountDesignatorRequest"
banno.user.id:[cc3c210f-7bd7-453f-a056-0cdde006c74]-C

Honeycomb:
service.name = netteller-bsl-service
body contains UpdateAccountDesignatorRequest
banno.user.id = [cc3c210f-7bd7-453f-a056-0cdde006c74]-C

Change Username

View Name: Banno Support-Change Username
Service:netteller-bsl-service
“SaveRetailAliasRequest”
banno.user.id:[12337b02-b8f9-4de1-8899-b4fbf24822e8]-C

Honeycomb:
service.name = netteller-bsl-service
body contains SaveRetailAliasRequest
banno.user.id = [12337b02-b8f9-4de1-8899-b4fbf24822e8]-C

Change Email

View Name: Banno Support-Change Email
Service:netteller-bsl-service
“SaveEmailAddressesRequest”
banno.user.id:[7c7e1728-d2fe-4dd8-b32e-db775a3ed199]-C

Honeycomb:
service.name = netteller-bsl-service
body contains SaveEmailAddressesRequest
banno.user.id = [7c7e1728-d2fe-4dd8-b32e-db775a3ed199]-C

Additional info from Espresso

Change Phone

View Name: Banno Support-Change Phone
Call to core via jx to modify customer information (on the CIF)
“CustMod”
banno.user.id:[43dc392f-3bf5-4656-9ccd-b85dec105998]-C

Honeycomb:
body conatins CustMod
banno.user.id = [43dc392f-3bf5-4656-9ccd-b85dec105998]-C

View Name: Banno Support-SaveRetailPasswordRequest
Request to save a retail user’s password change
“SaveRetailPasswordRequest”
banno.user.netteller.id:[610300189584]-C

Honeycomb:
body contains SaveRetailPasswordRequest
banno.user.netteller.id = [610300189584]-C

Online User Being Logged Out

View Name: Banno Support- Online User Being Logged Out
banno.user.id:[839d1f10-5a69-410c-a10d-7088f0da881f]-C,R
banno.institution.id:[566df890-abb7-11e4-bcd8-0800200c9a66]-C,R
“InvalidIP”-C
Use “institution_id” and leave out “user_id” if you want to see if it is happening FI wide. This log correlates to when a user logs out of Online due to their IP address changing from the one they validated with.

Honeycomb:
banno.user.id = [839d1f10-5a69-410c-a10d-7088f0da881f]-C,R
banno.institution.id = [566df890-abb7-11e4-bcd8-0800200c9a66]-C,R
body contains InvalidIP -C
Use “institution_id” and leave out “user_id” if you want to see if it is happening FI wide. This log correlates to when a user logs out of Online due to their IP address changing from the one they validated with.

Banno People AuthZ Searching

View Name: Banno Support- Remember Me
This can be used if they claim “Remember Me” isn’t working.
"remember me"
service:api
banno.user.id:[b61eea3b-b321-46c3-b1c8-a08c1388d800]-C

Honeycomb:
body contains remember me
service.name = api
banno.user.id = [b61eea3b-b321-46c3-b1c8-a08c1388d800]-C

Alerts

View Name: Banno Support-Alerts
“NotSMSAlrtAdd” - jX request made to create an SMS alert

or

“NotEmailAlrtAdd” - jX request made to create an email alert
Delete the one you do not need
banno.user.id:[2713bc6c-4ac2-4a5c-b3b7-7ab5a8195790]-C
The unique Banno user id used in most places
service:jxchange-api

Honeycomb:
body contains NotSMSAlrtAdd - jX request made to create an SMS alert

or

body contains NotEmailAlrtAdd - jX request made to create an email alert
Delete the one you do not need
banno.user.id = [2713bc6c-4ac2-4a5c-b3b7-7ab5a8195790]-C
The unique Banno user id used in most places
service.name = jxchange-api

If routing a case to the ENS group for alerts cases, change the product to jxchange. Change the provider group to EIS Shared services (you will need to manually look for that group).

High Risk action

View Name: Banno Support-High Risk
“HighRiskAuthResponded”
""fullName":"William Ehret""-C

Honeycomb:
body contains HighRiskAuthResponded
body contains "fullName":"William Ehret" -C

Xperience SSO

View Name: Banno Support-Xperience SSO
When users are having issues connecting from Xperience to Banno, search using the following filter and narrow down to the date and time.
service:enterprise-auth-xperience-sso
status:info
"email: thoffman@pvbank.com"-C
Search by email address of the user attempting the connection (sometimes gets logged depending on the error).

Honeycomb:
service.name = enterprise-auth-xperience-sso
status = info
body contains email: thoffman@pvbank.com -C
Search by email address of the user attempting the connection (sometimes gets logged depending on the error).

Zelle DATA SERVICES GUIDE

The link above takes you to the Zelle document and provides further details about Zelle and the Datadog calls.

View Name: Banno Support - PmtHubUsrDirInq
"PmtHubUsrDirInq"
"<LegalEntityId>XXX7193</LegalEntityId>"-C

Honeycomb:
body contains PmtHubUsrDirInq
body contains <LegalEntityId>XXX7193</LegalEntityId> -C

View Name: Banno Support - PmtHubUsrDirAdd
“PmtHubUsrDirAdd”
"<UsrToken>18572333571</UsrToken>"-C

Honeycomb:
body contains PmtHubUsrDirAdd
body contains <UsrToken>18572333571</UsrToken> -C

View Name: Banno Support - PmtHubCrXferAdd
"PmtHubCrXferAdd"
"<CrUsrToken>12036857348</CrUsrToken>"-C
" <XferAmt>40.00</XferAmt>"-C

Honeycomb:
body contains PmtHubCrXferAdd
body contains <CrUsrToken>12036857348</CrUsrToken> -C
body contains <XferAmt>40.00</XferAmt> -C

View Name: Banno Support - PmtHubUsrActSrch
"PmtHubUsrActSrch"
"<UsrToken>12319070132</UsrToken>"-C

Honeycomb:
body contains PmtHubUsrActSrch
body contains <UsrToken>12319070132</UsrToken> -C

View Name: Banno Support - PmtHubPmtRqAdd
"PmtHubPmtRqAdd"
"<RqUsrToken>vonscott12@outlook.com</RqUsrToken>"-C

Honeycomb:
body contains PmtHubPmtRqAdd
body contains <RqUsrToken>vonscott12@outlook.com</RqUsrToken> -C

Banno Support-Zelle-Service
service:*zelle\-service*
banno.user.id:[9415f1f0-6f03-11e6-b34a-02422f6950f7]-C
Above will give you a broader overview of Zelle pieces

Honeycomb:
service.name contains zelle
banno.user.id = [9415f1f0-6f03-11e6-b34a-02422f6950f7]-C
Above will give you a broader overview of Zelle pieces

Note for any feature utilizing the BSL: Most utilized operations can be found in the BSL Guide and can be searched with service:netteller-bsl-service and querying for the Operation used.

Approve ACH/Wire

View Name: Banno Support- Approve ACH/Wire
service:godough-api
banno.user.id:[16e12072-4358-43dd-8b01-140a2a82ac78]-C

Honeycomb:
service.name = godough-api
banno.user.id = [16e12072-4358-43dd-8b01-140a2a82ac78]-C

ESI Integrated Documents

Gather Enrollment Information GetEnrollmentInformation app_name:bsl-interface-service banno.user.netteller.id:[NetTellerID]

Honeycomb:
body contains GetEnrollmentInformation
app_name = bsl-interface-service
banno.user.netteller.id = [NetTellerID]

SYMXCHANGE CALLS

If a credit union goes down and is confused why, if it’s a SymX restart that causes it. If they restart or refresh SymX, Episys creates a report called SymXchange Posting Journal. You can tell them to look for that around the down time and see if that happened.

View Name: Banno Support-getAccountSelectFieldsFilterChildren
"getAccountSelectFieldsFilterChildren"
"<UserName>MARYROSE</UserName>"-C

Honeycomb:
body contains getAccountSelectFieldsFilterChildren
body contains <UserName>MARYROSE</UserName> -C

  • Returns a user’s name/contact/demographic (but NOT phone number, that is separate using getNameListSelectFields), primary accounts, including the share/loan ID (2 or 4 digits), balances, payment due for loans. Also returns the Preference Record (info about other accounts the user can access, among other things). First call made during a sync (only call that will fail a sync)… also made during batches or sign-in. Note: this call could be made a second time if the Preference Record indicates that the user has access to another member’s accounts. Request will include username; onlinerequestID for syncs will also be included. This seems to have elements of CustInq, IntNetFinInstIdInq and AcctInq.

View Name: Banno Support-getShareSelectFieldsFilterChildren
"getShareSelectFieldsFilterChildren"
"<UserName>DEBBIEDUREN</UserName>"-C

Honeycomb:
body contains getShareSelectFieldsFilterChildren
body contains <UserName>DEBBIEDUREN</UserName> -C

  • Can be used to get transactions for a user’s account OR to get info about another member’s share the user has access to (when they have access to a single account rather than all of the other member’s accounts). When using it to get transactions, you will see dates populated within . Masked account numbers + share ID, and username is also included. Transactions in response—the transactions in the response are not 1:1 to what the user sees. The response may have several “transaction” entries that are all one transaction. One will be the actual monetary transaction (includes an ActionCode and CommentCode>0, and BalanceChange values.) The transactions that are supplemental for a monetary transaction will not include the ActionCode or BalanceChange and will have CommentCode>1 (or at least not 0).

View Name: Banno Support-getShareTransactionPagedListSelectFields
"getShareTransactionPagedListSelectFields"
"<UserName>DARLEANDAILEY</UserName>"-C

Honeycomb:
body contains getShareTransactionPagedListSelectFields
body contains <UserName>DARLEANDAILEY</UserName> -C

If page_transactions is true in institution_symxchange_configs table, you’ll see this operation instead of getShareSelectFieldsFilterChildren.

View Name: Banno Support-searchTrackingSelectFields
"searchTrackingSelectFields"
"<UserName>CWCINPS76</UserName>"-C

Honeycomb:
body contains searchTrackingSelectFields
body contains <UserName>CWCINPS76</UserName> -C

Used to retrieve the NT ID.
If ATRs are configured, can be found by searching “Type=tracking_number (found in and username).

View Name:Banno Support-getLoanSelectFieldsFilterChildren
"getLoanSelectFieldsFilterChildren"
"<UserName>KWPULLEY</UserName>"-C

Honeycomb:
body contains getLoanSelectFieldsFilterChildren
body contains <UserName>KWPULLEY</UserName> -C

Same as getShareSelectFieldsFilterChildren but for loans.

View Name: Banno Support-getLoanTransactionPagedListSelectFields
"getLoanTransactionPagedListSelectFields"
"<UserName>DANA201</UserName>"-C

Honeycomb:
body contains getLoanTransactionPagedListSelectFields
body contains <UserName>DANA201</UserName> -C

If page_transactions is true in institution_symxchange_configs table, you’ll see this operation instead of getLoanSelectFieldsFilterChildren.

View Name: Banno Support-getNameListSelectFields
"getNameListSelectFields"

Honeycomb:
body contains getNameListSelectFields

We believe this call is made when the FI has two_fa_phone_validation enabled for 2FA. Type>0 means the primary name for the NTID (there can be multiple… joint etc… we’re only getting/using the primary person’s phone # we think). Search by username. We ask for:

  • HomePhone
  • MobilePhone
  • WorkPhone

View Name: BannoSupport-executePowerOn
"executePowerOn"
"SYMX.TRANSFERLIST.BANNO.V5"-C
"<UserName>HOTCHEETOS01</UserName>"-C

Honeycomb:
body contains executePowerOn
body contains SYMX.TRANSFERLIST.BANNO.V5 -C
body contains <UserName>HOTCHEETOS01</UserName> -C

This operation can be made for various things. A file name is included to differentiate what type of PowerOn is being called. Each PowerOn has to be installed on the core (during implementation).

  • SYMX.ACH.INQUIRY - this is the file for getting pending transactions. Pendings are 1:1 w/ the Banno transactions (you won’t see multiple transactions that are all actually one transaction). Make one call per member number that you need transactions for (so if the member has access to another member’s accounts the call has to be made separately for that secondary member number). Possible other pending poweron names: BANNO.PENDING_TRANS.INQUIRY.V2 (DOW)
    • Note: For CU’s most transactions post real-time so often there are no pendings. When there are none, you’ll see Total lines=0.
  • SYMX.TRANSFERLIST.BANNO.V5 - this is the file for getting transfer accounts and entitlements.

View Name: Banno Support- updateAccountByID
Similar to CustMod used when changing phone
"updateAccountByID"
"<UserName>THESLAYERS</UserName>"-C

Honeycomb:
body contains updateAccountByID
body contains <UserName>THESLAYERS</UserName> -C

View Name: Banno Support-createShareTransfer
"createShareTransfer"
" <UserName>WGBROWNLEE</UserName>"-C

Honeycomb:
body contains createShareTransfer
body contains <UserName>WGBROWNLEE</UserName> -C

View Name: Banno Support-CreateScheduledTransfer
“CreateScheduledTransfer”
"accountNumber = XXX3553"-C. This can be the to or from account.
"amount = 250.00"-C,D

Honeycomb:
body contains CreateScheduledTransfer
body contains accountNumber = XXX3553 -C. This can be the to or from account.
body contains amount = 250.00 -C,D

View Name: Banno Support-getShareTransferListSelectFields
"getShareTransferListSelectFields"
"<UserName>JNELSON</UserName>"-C

Honeycomb:
body contains getShareTransferListSelectFields
body contains <UserName>JNELSON</UserName> -C

[Transfer example](https://gist.github.com/hollyminer/e5597801f82aacd985ec4ebbaa9fa417)<br> </Request><br> </tns1:transfer>

View Name: Banno Support-UpdateCardByID Update debit card status (similar to EFTCardMod)
"UpdateCardByID"
"<UserName>MAFLETCHER</UserName>"-C
"<AccountNumber>XXX7144</AccountNumber>"-C

Honeycomb:
body contains UpdateCardByID
body contains <UserName>MAFLETCHER</UserName> -C
body contains <AccountNumber>XXX7144</AccountNumber> -C

View Name: Banno Support:-SearchCardSelectFields
Get list of debit cards (similar to EFTCardSrch)
"SearchCardSelectFields"
"<UserName>DENISLACKEY</UserName>"-C
"<Number>XXX5760</Number>"-C

Honeycomb:
body contains SearchCardSelectFields
body contains <UserName>DENISLACKEY</UserName> -C
body contains <Number>XXX5760</Number> -C

View name: Banno Support-ExternalTransfers
Use one of the following with the username:

  • "<UserName>BSKILES81</UserName>"-C
  • “createEft”-A
    • You can also add an amount to this one “<PostAmount>500.00</PostAmount>”
  • “deleteEft”-A
  • “getEftListSelectFields”-A
  • “getEftSelectFields[1] ”-A
  • “updateEftByID”-A

Honeycomb:

  • body contains <UserName>BSKILES81</UserName> -C
  • body contains createEft -A
    • You can also add an amount to this one body contains <PostAmount>500.00</PostAmount>
  • body contains deleteEft -A
  • body contains getEftListSelectFields -A
  • body contains getEftSelectFields[1] -A
  • body contains updateEftByID -A

View Name: Banno Support-CU CARD
“SYMXCHANGE INTERACTION”
"<Card>"
"<UserName>OBIWAN623</UserName>"-C
"<Number>XXX1844</Number>"-C
You can also add any keyword in messages to narrow the search down as in the example below. Copy the field and put it within quotes.

  • Example: “<ActiveDate>2019-11-22</ActiveDate>”

Honeycomb:
body contains SYMXCHANGE INTERACTION
body contains <Card>
body contains <UserName>OBIWAN623</UserName> -C
body contains <Number>XXX1844</Number> -C
You can also add any keyword in messages to narrow the search down as in the example below. Copy the field and put it within quotes.

  • Example: body contains <ActiveDate>2019-11-22</ActiveDate>

Card Status

Example case: 12569258
Customer was not getting an Active toggle switch. Looked at the the symx:
<Card>
<ActiveDate>2019-11-22</ActiveDate>
<ChkId>0008</ChkId>
<ExpirationDate>2021-12-01</ExpirationDate>
<InstantIssue>0</InstantIssue>
<IssueDate>2019-11-08</IssueDate>
<Locator>151</Locator>
<NameType>0</NameType>
<Number>XXX5742</Number>
<ReissueCode>0</ReissueCode>
<SavId>0000</SavId>
<Status>1</Status>
<StatusReason>0</StatusReason>
<Type>15</Type>

We looked at the status, then looked to the Reissue Code. Since the toggle switch was disabled, we looked to see which ReissueCode = 0. Determined that this card was set to Active - DoNotReorder.

PhishLabs

View Name: Banno PhishLabs

  • “env:production”
  • “app_name:web-server”
  • “banno.institution.id:<institution_id>”-C
  • “phishlabs”

Honeycomb:

  • app_name = web-server
  • banno.institution.id = <institution_id> -C
  • body contains phishlabs