DBotFindSimilarIncidents

Finds past similar incidents based on incident fields' similarity. Includes an option to also display indicators similarity. Note: For the similarity calculation, at least one field must be provided in one of the "similarTextField", "similarCategoricalField", or "similarJsonField" arguments.

python · Base

Details

ID	`DBotFindSimilarIncidents`
Language	python
From Version	5.0.0
Docker Image	`demisto/sklearn:1.0.0.12545527`

README

Find past similar incidents based on incident fields’ similarity. Includes an option to also display indicators similarity.
Note: For the similarity calculation, at least one field must be provided in one of the “similarTextField”, “similarCategoricalField”, or “similarJsonField” arguments.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	5.0.0

Used In

This script is used in the following playbooks and scripts.

Cortex XDR incident handling v3
Dedup - Generic v4
Endpoint Malware Investigation - Generic V2

Inputs

Argument Name	Description
incidentId	Incident ID to get the prediction of. If empty, predicts the the current incident ID.
similarTextField	Comma-separated list of incident text fields to take into account when computing similarity. For example: commandline, URL. Note: In order to calculate similarity, fields must consist of a minimum of 2 letters.
similarCategoricalField	Comma-separated list of incident categorical fields to take into account whe computing similarity. For example: IP, URL. Note: In order to calculate similarity, fields must consist of a minimum of 2 letters.
similarJsonField	Comma-separated list of incident JSON fields to take into account whe computing similarity. For example: CustomFields. Note: In order to calculate similarity, fields must consist of a minimum of 2 letters.
fieldsToDisplay	Comma-separated list of additional incident fields to display, but which will not be taken into account when computing similarity.
fieldExactMatch	Comma-separated list of incident fields that have to be equal to the current incident fields. This helps reduce the query size. These fields are not part of the similarity calculation.
useAllFields	Whether to use a predefined set of fields and custom fields to compute similarity. If “True”, it will ignore values in similarTextField, similarCategoricalField, similarJsonField.
fromDate	The start date by which to filter incidents. Date format will be the same as in the incidents query page, for example, “3 days ago”, ““2019-01-01T00:00:00 +0200”).
toDate	The end date by which to filter incidents. Date format will be the same as in the incidents query page, for example, “3 days ago”, ““2019-01-01T00:00:00 +0200”).
query	Argument for the query. This helps reduce the query size.
limit	The maximum number of incidents to query.
aggreagateIncidentsDifferentDate	Whether to aggregate duplicate incidents within diffrerent dates.
showIncidentSimilarityForAllFields	Whether to display the similarity score for each of the incident fields.
minimunIncidentSimilarity	Retain incidents with similarity score that’s higher than the MinimunIncidentSimilarity.
maxIncidentsToDisplay	The maximum number of incidents to display.
showCurrentIncident	Whether to display the current incident.
includeIndicatorsSimilarity	Whether to include similarity of indicators from DBotFindSimilarIncidentsByIndicators in the final score.
minNumberOfIndicators	The minimum number of indicators required related to the incident before running the model. Relevant if includeIndicatorsSimilarity is “True”.
indicatorsTypes	Comma-separated list of indicator types to take into account. If empty, uses all indicators types. Relevant if includeIndicatorsSimilarity is “True”.
maxIncidentsInIndicatorsForWhiteList	Help to filter out indicators that appear in many incidents. Relevant if includeIndicatorsSimilarity is “True”.

Outputs

There are no outputs for this script.

Source

DBotFindSimilarIncidents.py DBotFindSimilarIncidents_test.py DBotFindSimilarIncidents.yml

Download History Raw

args:
- description: Incident ID to get the prediction of. If empty, predicts the the current incident ID.
  name: incidentId
- auto: PREDEFINED
  description: 'Comma-separated list of incident text fields to take into account when computing similarity. For example: commandline, URL. Note: In order to calculate similarity, fields must consist of a minimum of 2 letters.'
  name: similarTextField
- auto: PREDEFINED
  description: 'Comma-separated list of incident categorical fields to take into account whe computing similarity. For example: IP, URL. Note: In order to calculate similarity, fields must consist of a minimum of 2 letters.'
  name: similarCategoricalField
- auto: PREDEFINED
  description: 'Comma-separated list of incident JSON fields to take into account whe computing similarity. For example: CustomFields. Note: In order to calculate similarity, fields must consist of a minimum of 2 letters.'
  name: similarJsonField
- auto: PREDEFINED
  description: Comma-separated list of additional incident fields to display, but which will not be taken into account when computing similarity.
  name: fieldsToDisplay
- auto: PREDEFINED
  description: Comma-separated list of incident fields that have to be equal to the current incident fields. This helps reduce the query size. These fields are not part of the similarity calculation.
  name: fieldExactMatch
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to use a predefined set of fields and custom fields to compute similarity. If "True", it will ignore values in similarTextField, similarCategoricalField, similarJsonField.
  name: useAllFields
  predefined:
  - 'True'
  - 'False'
- defaultValue: 1 months ago
  description: The start date by which to filter incidents. Date format will be the same as in the incidents query page, for example, "3 days ago", ""2019-01-01T00:00:00 +0200").
  name: fromDate
- description: The end date by which to filter incidents. Date format will be the same as in the incidents query page, for example, "3 days ago", ""2019-01-01T00:00:00 +0200").
  name: toDate
- description: Argument for the query. This helps reduce the query size.
  name: query
- defaultValue: '1500'
  description: The maximum number of incidents to query.
  name: limit
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to aggregate duplicate incidents within diffrerent dates.
  name: aggreagateIncidentsDifferentDate
  predefined:
  - 'True'
  - 'False'
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to display the similarity score for each of the incident fields.
  name: showIncidentSimilarityForAllFields
  predefined:
  - 'True'
  - 'False'
- defaultValue: '0.2'
  description: Retain incidents with similarity score that's higher than the MinimunIncidentSimilarity.
  name: minimunIncidentSimilarity
- defaultValue: '100'
  description: The maximum number of incidents to display.
  name: maxIncidentsToDisplay
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to display the current incident.
  name: showCurrentIncident
  predefined:
  - 'True'
  - 'False'
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to include similarity of indicators from DBotFindSimilarIncidentsByIndicators in the final score.
  name: includeIndicatorsSimilarity
  predefined:
  - 'True'
  - 'False'
- description: The minimum number of indicators required related to the incident before running the model. Relevant if includeIndicatorsSimilarity is "True".
  name: minNumberOfIndicators
- auto: PREDEFINED
  description: Comma-separated list of indicator types to take into account. If empty, uses all indicators types. Relevant if includeIndicatorsSimilarity is "True".
  name: indicatorsTypes
- description: Help to filter out indicators that appear in many incidents. Relevant if includeIndicatorsSimilarity is "True".
  name: maxIncidentsInIndicatorsForWhiteList
comment: |-
  Finds past similar incidents based on incident fields' similarity. Includes an option to also display indicators similarity.
  Note: For the similarity calculation, at least one field must be provided in one of the "similarTextField", "similarCategoricalField", or "similarJsonField" arguments.
commonfields:
  id: DBotFindSimilarIncidents
  version: -1
enabled: true
name: DBotFindSimilarIncidents
script: '-'
subtype: python3
timeout: '0'
type: python
dockerimage: demisto/sklearn:1.0.0.12545527
runas: DBotWeakRole
tests:
- DBotFindSimilarIncidents-test
fromversion: 5.0.0
outputs:
- contextPath: DBotFindSimilarIncidents.isSimilarIncidentFound
  description: Indicates whether similar incidents have been found.
  type: boolean
- contextPath: DBotFindSimilarIncidents.similarIncident.created
  description: The creation date of the linked incident.
  type: date
- contextPath: DBotFindSimilarIncidents.similarIncident.id
  description: The ID of the linked incident.
  type: string
- contextPath: DBotFindSimilarIncidents.similarIncident.name
  description: The name of the linked incident.
  type: string
- contextPath: DBotFindSimilarIncidents.similarIncident.similarity incident
  description: The similarity of the linked incident represented as a float in the range 0-1.
  type: number
- contextPath: DBotFindSimilarIncidents.similarIncident.details
  description: The details of the linked incident.
  type: string
autoUpdateDockerImage: false