DBot Create Phishing Classifier V2

id: DBot Create Phishing Classifier V2
version: -1
name: DBot Create Phishing Classifier V2
description: Create a phishing classifier using machine learning techniques, based on email content.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f96785c7-7d04-4f99-8da3-929501848239
    type: start
    task:
      id: f96785c7-7d04-4f99-8da3-929501848239
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: a9333d16-a1b0-4f04-8ce6-f13e0da7ebea
    type: title
    task:
      id: a9333d16-a1b0-4f04-8ce6-f13e0da7ebea
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 5e19ea89-ccf7-40c8-811b-f683ba5ac94a
    type: regular
    task:
      id: 5e19ea89-ccf7-40c8-811b-f683ba5ac94a
      version: -1
      name: Get Incidents
      description: Gets a list of incident objects and the associated incident outputs that match the specified query and filters. The results are returned in a structured data file.
      scriptName: GetIncidentsByQuery
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      NonEmptyFields:
        simple: ${inputs.emailTagKey}
      fromDate: {}
      incidentTypes:
        simple: ${inputs.incidentTypes}
      includeContext:
        simple: "false"
      limit:
        simple: ${inputs.maxIncidentsToFetchOnTraining}
      outputFormat:
        simple: ${inputs.outputFormat}
      populateFields:
        simple: ${inputs.emailTextKey},${inputs.emailSubjectKey},${inputs.emailTagKey}
      query:
        simple: ${ExtendQueryBasedOnPhishingLabels.extendedQuery}
      timeField:
        simple: created
      toDate: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: fc975c48-a318-4c51-86ab-f80d6957f6fc
    type: regular
    task:
      id: fc975c48-a318-4c51-86ab-f80d6957f6fc
      version: -1
      name: Pre-process file
      description: |-
        Pre-process text data for the machine learning text classifier.
        The pre-process normalizes the text:
        - Remove HTML tags.
        - Convert every word to it's root (goes -> go).
        - Remove sample text of which the total number of words are less than or equal to a threshold.
        - Remove emails with similarity greater than some threshold.
      scriptName: DBotPreProcessTextData
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      cleanHTML:
        simple: "true"
      dedupThreshold:
        simple: ${inputs.dedupThreshold}
      hashSeed:
        simple: ${inputs.hashData}
      input:
        simple: ${lastCompletedTaskEntries}
      inputType:
        simple: ${GetIncidentsByQuery.FileFormat}
      outputFormat:
        simple: ${inputs.outputFormat}
      preProcessType:
        simple: nlp
      removeShortTextThreshold:
        simple: ${inputs.removeShortTextThreshold}
      textFields:
        simple: ${inputs.emailSubjectKey},${inputs.emailTextKey}
      whitelistFields:
        simple: ${inputs.emailTagKey}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: f42d000f-11f8-43a8-8c65-f7fba092c75a
    type: regular
    task:
      id: f42d000f-11f8-43a8-8c65-f7fba092c75a
      version: -1
      name: Train Model
      description: Train the machine learning text classifier.
      scriptName: DBotTrainTextClassifierV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      input:
        simple: ${DBotPreProcessTextData.Filename},${inputs.historicalDataFileListName}
      inputType:
        complex:
          root: DBotPreProcessTextData
          accessor: FileFormat
          transformers:
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: _filename
      keywordMinScore: {}
      maxBelowThreshold: {}
      modelName:
        simple: ${inputs.modelName}
      overrideExistingModel:
        simple: ${inputs.overrideModel}
      phishingLabels:
        simple: ${inputs.phishingLabels}
      storeModel: {}
      tagField:
        simple: ${inputs.emailTagKey}
      targetAccuracy:
        simple: ${inputs.modelTargetAccuracy}
      textField:
        simple: ${DBotPreProcessTextData.TextFieldProcessed}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 0ee35628-0387-4595-84f8-17968fdabcdc
    type: condition
    task:
      id: 0ee35628-0387-4595-84f8-17968fdabcdc
      version: -1
      name: Historical data exist?
      description: Check if we have input with a historical data file - usually from an external source, or data we used to have in Cortex XSOAR.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.historicalDataFileListName
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: 7174d475-f61d-440b-80c7-dfe59c635595
    type: regular
    task:
      id: 7174d475-f61d-440b-80c7-dfe59c635595
      version: -1
      name: Get Historical File
      description: Converts a Base64 file in a list to a binary file and upload to the War Room.
      scriptName: Base64ListToFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      filename: {}
      isZipFile:
        simple: "no"
      listname:
        simple: ${inputs.historicalDataFileListName}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: c6f0a658-35a4-482b-817f-c28b0e060fa7
    type: regular
    task:
      id: c6f0a658-35a4-482b-817f-c28b0e060fa7
      version: -1
      name: Extend Query
      description: 'A helper script for DBot Create Phishing Classifier V2 playbook.
        This script extends the query based on the phishingLabels argument.'
      scriptName: ExtendQueryBasedOnPhishingLabels
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      phishingLabels:
        simple: ${inputs.phishingLabels}
      query:
        simple: ${inputs.incidentsQuery}
      tagField:
        simple: ${inputs.emailTagKey}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1260,
        "width": 492.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: modelName
  value:
    simple: phishing_model
  required: false
  description: The model name to store in the system.
- key: emailTextKey
  value:
    simple: emailbody|emailbodyhtml|details
  required: false
  description: A comma-separated list of incident fields names with the email body or html body. You can also use "|" if you want to choose the first non-empty value from a list of fields.
- key: emailSubjectKey
  value:
    simple: emailsubject|name
  required: false
  description: A comma-separated list of incident fields names with the email subject. You can also use "|" if you want to choose the first non-empty value from a list of fields.
- key: emailTagKey
  value:
    simple: emailclassification
  required: false
  description: The field name with the email tag. Supports a comma-separated list. The first non-empty value will be taken.
- key: phishingLabels
  value:
    simple: '*'
  required: false
  description: 'A comma-separated list of email tags values and mapping. The script considers only the tags specified in this field. You can map the label to another value by using this format: LABEL:MAPPED_LABEL. For example, for 4 values in an email tag: malicious, credentials harvesting, inner communication, external legit email, unclassified. While training, we want to ignore the "unclassified" tag, and refer to "credentials harvesting" as "malicious" too. Also, we want to merge "inner communication" and "external legit email" to a single tag called "non-malicious". The input will be: malicious, credentials harvesting:malicious, inner communication:non-malicious, external legit email:non-malicious.'
- key: incidentsQuery
  value: {}
  required: false
  description: The incidents query to fetch the training data for the model.
- key: maxIncidentsToFetchOnTraining
  value:
    simple: "3000"
  required: false
  description: The maximum number of incidents to fetch.
- key: hashSeed
  value: {}
  required: false
  description: If non-empty, hash every word with this seed.
- key: historicalDataFileListName
  value: {}
  required: false
  description: The name of the Cortex XSOAR list that contains historical data training samples for the model.
- key: overrideModel
  value:
    simple: "true"
  required: false
  description: Whether to override the existing model if a model with the same name exists. Default is "false".
- key: incidentTypes
  value:
    simple: Phishing
  required: false
  description: A common-separated list of incident types by which to filter.
- key: dedupThreshold
  value:
    simple: "0.99"
  required: false
  description: Remove emails with similarity greater than this threshold, range 0-1, where 1 is completely identical.
- key: removeShortTextThreshold
  value:
    simple: "15"
  required: false
  description: Sample text of which the total number words that are less than or equal to this number will be ignored.
- key: modelTargetAccuracy
  value:
    simple: "0.8"
  required: false
  description: The model target accuracy, between 0 and 1.
- key: outputFormat
  value:
    simple: pickle
  required: false
  description: The output file format. Can be "json" or "pickle".
outputs:
- contextPath: DBotPhishingClassifier.EvaluationScores.Precision.All
  description: Average binary precision over all classes (0-1).
  type: number
- contextPath: DBotPhishingClassifier.EvaluationScores.TP.All
  description: The number of instances of all classes that were predicted correctly.
  type: number
- contextPath: DBotPhishingClassifier.EvaluationScores.Coverage.All
  description: The number of instances that were predicted at a probability greater than the threshold.
  type: number
- contextPath: DBotPhishingClassifier.EvaluationScores.Total.All
  description: The total number of instances.
  type: number
- contextPath: DBotPhishingClassifier.ModelName
  description: The name of the model in Cortex XSOAR.
  type: string
fromversion: "5.0.0"
tests:
- Create Phishing Classifier V2 ML Test