DBot Create Phishing Classifier

Deprecated. Use "DBot Create Phishing Classifier V2" playbook instead. Create a phishing classifier using machine learning technique, based on email content

Pack

DeprecatedContent

Tasks

8

Inputs

• modelListStoreName — The name of Demisto list to store the model
• emailTextKey — Incident key to extract email body text
• emailSubjectKey — Incident key to extract email subject
• emailTagKey — Incident key expression to extract email tag
• phishingLabels — Comma-separated values of email tags values and mapping. The script going to consider only the tags specify in this field. You can map label to another value by using this format: LABEL:MAPPED_LABEL. For example: let's say we have 4 values in email tag: malicious, credentials harvesting, inner communitcation, external legit email, unclassified. While training, we want to ignore "unclassified" tag, and refer to "credentials harvesting" as "malicious" too. Also, we want to merge "inner communitcation" and "external legit email" to one tag called "non-malicious". The input will be: malicious, credentials harvesting:malicious, inner communitcation:non-malicious, external legit email:non-malicious
• incidentsTrainingQuery — The incidents query to fetch the training data for the model
• incidentsEvaluationQuery — The incidents query to fetch the test data for the model
• maxIncidentsToFetchOnTraining — Maximum number of incidents to fetch while training the model
• isContextNeeded — Is context data needed to get email text\subject\tag value?
• historicalDataFileListName — The name of demisto list contains historical data samples for the algorithm
• hashData — Preform hash function to the words (to anonymize the data). Choose between yes/no

Outputs

• DBotPredictPhishingEvaluation.F1 — F1 score (0-1)
• DBotPredictPhishingEvaluation.Precision — Precision score (0-1)
• DBotTextClassifier.ListName — Model list name in Demisto