DBot Create Phishing Classifier Deprecated Hidden

Deprecated. Use "DBot Create Phishing Classifier V2" playbook instead. Create a phishing classifier using machine learning technique, based on email content

Deprecated Content (Deprecated) · 8 tasks · 11 inputs · 3 outputs

Details

IDDBotCreatePhishingClassifier
From Version5.0.0
Tasks8

README

DEPRECATED. Use “DBot Create Phishing Classifier V2” playbook instead. Creates a phishing classifier using machine learning technique, based on the email content.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • DBotPredictPhishingEvaluation
  • DBotTrainTextClassifier
  • DBotPreparePhishingData
  • Base64ListToFile

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
modelListStoreName The name of the Cortex XSOAR list to store the model. phishing_model Optional
emailTextKey The incident key to extract email body text. details Optional
emailSubjectKey The incident key to extract email subject. emailsubject Optional
emailTagKey The incident key expression to extract email tag. closeReason Optional
phishingLabels The CSV list of email tags values and mapping. The script going to consider only the tags specified in this field. You can map label to another value by using this format: LABEL:MAPPED_LABEL. For example: let’s say we have 4 values in email tag: malicious, credentials harvesting, inner communitcation, external legit email, unclassified. While training, we want to ignore “unclassified” tag, and refer to “credentials harvesting” as “malicious” too. Also, we want to merge “inner communitcation” and “external legit email” to one tag called “non-malicious”. The input will be: malicious, credentials harvesting:malicious, inner communitcation:non-malicious, external legit email:non-malicious. * Optional
incidentsTrainingQuery The incidents query to fetch the training data for the model. type:Phishing and created:>=”180 days ago” and created:<”7 days ago” Optional
incidentsEvaluationQuery The incidents query to fetch the test data for the model. type:Phishing and created:>=”7 days ago” Optional
maxIncidentsToFetchOnTraining The maximum number of incidents to fetch while training the model. 2000 Optional
isContextNeeded Wether the context data needed to get email text\subject\tag value? no Optional
historicalDataFileListName The name of Cortex XSOAR list contains historical data samples for the algorithm. - Optional
hashData The preform hash function to the words (to anonymize the data). Choose “yes” or “no”. no Optional

Playbook Outputs

Path Description Type
DBotPredictPhishingEvaluation.F1 The F1 score (0-1). number
DBotPredictPhishingEvaluation.Precision The precision score (0-1). number
DBotTextClassifier.ListName The model list name in Cortex XSOAR. unknown

Playbook Image

DBotCreatePhishingClassifier

Inputs

  • modelListStoreName — The name of Demisto list to store the model
  • emailTextKey — Incident key to extract email body text
  • emailSubjectKey — Incident key to extract email subject
  • emailTagKey — Incident key expression to extract email tag
  • phishingLabels — Comma-separated values of email tags values and mapping. The script going to consider only the tags specify in this field. You can map label to another value by using this format: LABEL:MAPPED_LABEL. For example: let's say we have 4 values in email tag: malicious, credentials harvesting, inner communitcation, external legit email, unclassified. While training, we want to ignore "unclassified" tag, and refer to "credentials harvesting" as "malicious" too. Also, we want to merge "inner communitcation" and "external legit email" to one tag called "non-malicious". The input will be: malicious, credentials harvesting:malicious, inner communitcation:non-malicious, external legit email:non-malicious
  • incidentsTrainingQuery — The incidents query to fetch the training data for the model
  • incidentsEvaluationQuery — The incidents query to fetch the test data for the model
  • maxIncidentsToFetchOnTraining — Maximum number of incidents to fetch while training the model
  • isContextNeeded — Is context data needed to get email text\subject\tag value?
  • historicalDataFileListName — The name of demisto list contains historical data samples for the algorithm
  • hashData — Preform hash function to the words (to anonymize the data). Choose between yes/no

Outputs

  • DBotPredictPhishingEvaluation.F1 — F1 score (0-1)
  • DBotPredictPhishingEvaluation.Precision — Precision score (0-1)
  • DBotTextClassifier.ListName — Model list name in Demisto

Flowchart

yes yes Start Start Prepare phishing data - DBotPreparePhishingData Prepare phishing data DBotPreparePhishingData Train model - DBotTrainTextClassifier Train model DBotTrainTextClassifier Model evaluation - DBotPredictPhishingEvaluation Model evaluation DBotPredictPhishingEvaluation Done Done Is model trained? Is model trained? Historical data exist Historical data exist Get historical file - Base64ListToFile Get historical file Base64ListToFile

Source

playbook-DBotCreatePhishingClassifier.yml playbook-DBotCreatePhishingClassifierJob.yml playbook-DBotCreatePhishingClassifierJob_README.md
Download History Raw 
DEPRECATED. Use "DBot Create Phishing Classifier V2" playbook instead. Trains the phishing machine learning model. This playbook should be used as job, to run repeatedly, for example every week. 

## Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.

## Sub-playbooks
* DBotCreatePhishingClassifier

## Integrations
* Builtin

## Scripts
* DeleteContext

## Commands
* closeInvestigation

## Playbook Inputs
---
There are no inputs for this playbook.

## Playbook Outputs
---
There are no outputs for this playbook.

## Playbook Image
---
![DBotCreatePhishingClassifierJob](https://raw.githubusercontent.com/demisto/content/1bdd5229392bd86f0cc58265a24df23ee3f7e662/docs/images/playbooks/DBot_Create_Phishing_Classifier_Job.png)