AWS Sagemaker

Details

ID	`AWS Sagemaker`
Provider	Amazon
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/boto3py3:1.0.0.10221838`
Supported Modules	Agentix XSIAM

README

AWS Sagemaker - Cortex XSOAR Phishing Email Classifier

Configure AWS Sagemaker in Cortex

Parameter	Required
AWS access key	True
AWS secret key	True
AWS Region code	False
Endpoint Name	True
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

predict-phishing

Classify input text (usually email content)

Base Command

predict-phishing

Input

Argument Name	Description	Required
inputText	The input text (usually email subject + body).	Optional

Context Output

Path	Type	Description
DBotPhishingPrediction.Label	string	The predicated label: malicious \ other
DBotPhishingPrediction.Probability	number	The predication probability (range 0-1)

Command Example

!predict-phishing inputText="Dear Info, Please confirm account password...", "Major Update: General Availability feedback..."

Configuration parameters

credentials — AWS access key
AWSAccessKey — AWS access key
AWSSecretKey — AWS secret key
AWSRegion — AWS Region code
EndpointName — Endpoint Name (required)
sts_regional_endpoint — AWS STS Regional Endpoints
proxy — Use system proxy settings

Commands (1)

predict-phishing
Classify input text (usually email content).

Source

AWSSagemaker.py AWSSagemaker.yml AWSSagemaker_description.md

Download History Raw

commonfields:
  id: AWS Sagemaker
  version: -1
sectionorder:
- Connect
- Collect
name: AWS Sagemaker
display: AWS Sagemaker
category: Data Enrichment & Threat Intelligence
provider: Amazon
description: AWS Sagemaker - Demisto Phishing Email Classifier.
configuration:
- display: AWS access key
  name: credentials
  type: 9
  displaypassword: AWS secret key
  required: false
  section: Connect
- display: AWS access key
  name: AWSAccessKey
  defaultvalue: ""
  type: 0
  hidden: true
  required: false
  section: Connect
- display: AWS secret key
  name: AWSSecretKey
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
  section: Connect
- display: AWS Region code
  name: AWSRegion
  defaultvalue: "us-east-2"
  type: 0
  required: false
  section: Connect
- display: Endpoint Name
  name: EndpointName
  type: 0
  required: true
  defaultvalue: ""
  section: Connect
- display: AWS STS Regional Endpoints
  additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration.
  name: sts_regional_endpoint
  options:
  - legacy
  - regional
  type: 15
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: predict-phishing
    arguments:
    - name: inputText
      description: The input text (usually email subject + body).
    outputs:
    - contextPath: DBotPhishingPrediction.Label
      description: 'The predicated label: malicious \ other.'
      type: string
    - contextPath: DBotPhishingPrediction.Probability
      description: The predication probability (range 0-1).
      type: number
    description: Classify input text (usually email content).
  dockerimage: demisto/boto3py3:1.0.0.10221838
tests:
- Test Sagemaker
fromversion: 5.0.0