Machine Learning

Details
Content
Version History

Help to manage machine learning models in Cortex XSOAR

PUBLISHER

Cortex XSOAR

INFO

Certification	Certified	Read more
Supported By	Cortex XSOAR
Created	June 30, 2020
Last Release	October 20, 2021

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.

Automations

Name	Description
ImportMLModel	Imports a file that contains an ML model.
DBotPredictOutOfTheBoxV2	Predict phishing incidents using the out-of-the-box pre-trained model.
DBotPredictOutOfTheBox	Deprecated. Use DBotPredictOutOfTheBoxV2 instead.
HashIncidentsFields	Hash fields from the incident list. Search for incidents by arguments with an option to hash some of its fields.
EvaluateMLModllAtProduction	Evaluates an ML model in production.
ExportMLModel	Exports an existing ML model to a file.
DBotPredictIncidentsBatch	Apply a trained ML model on multiple incidents at once, to compare incidents how the incidents were labeled by analysts, to the predictions of the model. This script is aimed to help evaluate a trained model using past incidents.

Playbooks

Name	Description
DBot Create Phishing Classifier V2	Create a phishing classifier using machine learning technique, based on email content.
DBot Create Phishing Classifier V2 From File	Create a phishing classifier using machine learning. The classifier is based on incidents files extracted from email content.
DBot Create Phishing Classifier V2 Job	Train the phishing machine learning model. This playbook should be used as job, to run repeatedly, for example every week.

1.3.6 - 1820031 (October 20, 2021)

Scripts

DBotPredictOutOfTheBox

Deprecated. Use DBotPredictOutOfTheBoxV2 instead.

1.3.5 - 7772209 (September 25, 2021)

Scripts

ExportMLModel

Updated the Docker image to: demisto/python3:3.9.7.24076.

ImportMLModel

Updated the Docker image to: demisto/python3:3.9.7.24076.

1.3.4 - 7719350 (September 22, 2021)

Scripts

HashIncidentsFields

Updated the Docker image to: demisto/python3:3.9.7.24076.

1.3.3 - 412210 (August 16, 2021)

Scripts

HashIncidentsFields

Internal code improvements.
Updated the Docker image to: demisto/python3:3.9.6.22912.

1.3.2 - 410734 (August 12, 2021)

Scripts

EvaluateMLModllAtProduction

Updated the Docker image to: demisto/ml:1.0.0.23334.

DBotPredictIncidentsBatch

Updated the Docker image to: demisto/ml:1.0.0.23334.

1.3.1 - 388541 (June 22, 2021)

Scripts

ExportMLModel

Upgraded the Docker image to: demisto/python3:3.9.5.21272.

ImportMLModel

Upgraded the Docker image to: demisto/python3:3.9.5.21272.

1.3.0 - 376375 (June 3, 2021)

Scripts

DBotPredictIncidentsBatch

Maintenance and stability enhancements.
Updated the Docker image to: demisto/ml:1.0.0.20606.

DBotPredictOutOfTheBoxV2

Updated the out-of-the-box model version.
Updated the Docker image to: demisto/ml:1.0.0.20606.

1.2.9 - 366242 (May 25, 2021)

Scripts

DBotPredictOutOfTheBoxV2

Updated the out-of-the-box model version.

1.2.8 - 342151 (May 2, 2021)

Scripts

DBotPredictIncidentsBatch

Maintenance and stability enhancements.

1.2.7 - 341097 (April 29, 2021)

Scripts

DBotPredictOutOfTheBoxV2

Updated the out-of-the-box model version.
Added a mechanism to update the out-of-the-box model when a newer version is released.

1.2.6 - 336317 (April 25, 2021)

Scripts

New: DBotPredictIncidentsBatch

Apply a trained ML model on multiple incidents at once, to compare incidents how the incidents were labeled by analysts, to the predictions of the model. This script is aimed to help evaluate a trained model using past incidents.

1.2.5 - 331662 (April 20, 2021)

Scripts

DBotPredictOutOfTheBoxV2

Updated the Docker image to: demisto/ml:1.0.0.19023.

1.2.4 - 327772 (April 13, 2021)

Scripts

New: DBotPredictOutOfTheBoxV2

Predict phishing incidents using the out-of-the-box pre-trained model.

1.2.3 - 322974 (April 7, 2021)

Scripts

ImportMLModel

Added the modelStoreType argument, which enables importing an ML model as lists.

1.2.2 - 269341 (February 2, 2021)

Scripts

EvaluateMLModllAtProduction

Maintenance and stability enhancements.
Updated the Docker image to: demisto/ml:1.0.0.15569.

1.2.1 - R264879 (January 27, 2021)

Scripts

HashIncidentsFields

Fixed an issue where custom fields were returned by default as part of the incident object.

1.2.0 - R163584 (October 28, 2020)

Scripts

DBotPredictOutOfTheBox

Changed the name of labelProbabilityThreshold argument to confidenceThreshold.

1.1.2 - 101485 (September 2, 2020)

Scripts

HashIncidentsFields

Added support for wildcards in fieldsToHash.
Added the un-populate and removeLabels arguments.

1.1.1 - 87888 (August 13, 2020)

Scripts

EvaluateMLModllAtProduction

Bumped docker image version.

1.1.0 - 60526 (June 30, 2020)

Scripts

HashIncidentsFields

Hash fields from incident list. Search for incidents by arguments with an option to hash some of its fields