DBotFindSimilarIncidentsByIndicators
Finds similar incidents based on indicators' similarity. Indicators' contribution to the final score is based on their scarcity.
python · Base
Details
| ID | DBotFindSimilarIncidentsByIndicators |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/sklearn:1.0.0.12545527 |
README
Finds similar incidents based on indicators’ similarity. Indicators’ contribution to the final score is based on their scarcity.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Cortex XSOAR Version | 5.0.0 |
Used In
This script is used in the following playbooks and scripts.
- Dedup - Generic v4
Inputs
| Argument Name | Description |
|---|---|
| incidentId | Incident ID to get the prediction of. If empty, predicts the current incident ID. |
| maxIncidentsInIndicatorsForWhiteList | The maximum number of incidents that an indicator can be associated with to be retained. This helps to filter out indicators that appear in many incidents |
| minNumberOfIndicators | The minimum number of indicators related to the incident required before running the model. |
| threshold | Threshold to similarity value which is between 0 and 1. |
| indicatorsTypes | Type of indicators to take into account. If empty, uses all indicators types. |
| showActualIncident | Whether to show the incident you are investigating. |
| maxIncidentsToDisplay | The maximum number of incidents to display. |
| fieldsIncidentToDisplay | Fields to add in the table of incident |
| fromDate | The start date by which we retrieve information on incidents. |
| query | Argument for the query of similar incidents. |
Outputs
There are no outputs for this script.
args: - description: Incident ID to get the prediction of. If empty, predicts the current incident ID. name: incidentId predefined: - '' - defaultValue: '150' description: 'The maximum number of incidents that an indicator can be associated with to be retained. This helps to filter out indicators that appear in many incidents.' name: maxIncidentsInIndicatorsForWhiteList - defaultValue: '1' description: The minimum number of indicators related to the incident required before running the model. name: minNumberOfIndicators - defaultValue: '0' description: Threshold to similarity value which is between 0 and 1. name: threshold - description: Type of indicators to take into account. If empty, uses all indicators types. name: indicatorsTypes - auto: PREDEFINED defaultValue: 'False' description: Whether to show the incident you are investigating. name: showActualIncident predefined: - 'True' - 'False' - defaultValue: '50' description: The maximum number of incidents to display. name: maxIncidentsToDisplay - defaultValue: type, created, name description: Fields to add in the table of incident. name: fieldsIncidentToDisplay - defaultValue: 1 month ago description: The start date by which we retrieve information on incidents. name: fromDate - description: Argument for the query of similar incidents. name: query comment: Finds similar incidents based on indicators' similarity. Indicators' contribution to the final score is based on their scarcity. commonfields: id: DBotFindSimilarIncidentsByIndicators version: -1 enabled: true name: DBotFindSimilarIncidentsByIndicators script: '-' subtype: python3 timeout: '0' type: python dockerimage: demisto/sklearn:1.0.0.12545527 runas: DBotWeakRole tests: - DBotFindSimilarIncidentsByIndicators - Test fromversion: 5.0.0