DBotTrainTextClassifierV2

args:
- description: The input file entry ID or JSON string.
  name: input
  required: true
- defaultValue: phishing_model
  description: The model name to store in the system.
  name: modelName
- auto: PREDEFINED
  defaultValue: 'true'
  description: Whether to store the model in the system.
  name: storeModel
  predefined:
  - 'true'
  - 'false'
- auto: PREDEFINED
  description: Whether to override the existing model if a model with the same name exists. Default is "false".
  name: overrideExistingModel
  predefined:
  - 'true'
  - 'false'
- defaultValue: '0.8'
  description: The target accuracy, between 0 and 1. Default is 0.8.
  name: targetAccuracy
- description: Maximum nubmer of samples below the threshold (for the target accuracy).
  name: maxBelowThreshold
- description: The field name with the label. Supports a comma-separated list, the first non-empty value will be taken.
  name: tagField
  required: true
- defaultValue: dbot_processed_text
  description: The field name with the text to train.
  name: textField
- defaultValue: '*'
  description: 'A comma-separated list of email tags values and mapping. The script considers only the tags specified in this field. You can map label to another value by using this format: LABEL:MAPPED_LABEL. For example, for 4 values in email tag: malicious, credentials harvesting, inner communitcation, external legit email, unclassified. While training, we want to ignore "unclassified" tag, and refer to "credentials harvesting" as "malicious" too. Also, we want to     merge "inner communitcation" and "external legit email" to one tag called "non-malicious". The input will be: malicious, credentials harvesting:malicious, inner communitcation:non-malicious, external legit email:non-malicious.'
  name: phishingLabels
- defaultValue: '0.8'
  description: The ratio of the training set to the entire data set, which is used for model evaluation.
  name: trainSetRatio
- auto: PREDEFINED
  defaultValue: pickle_filename
  description: The input type.
  name: inputType
  predefined:
  - json
  - json_string
  - json_b64_string
  - pickle
  - pickle_string
  - pickle_b64_string
  - pickle_filename
  - json_filename
- defaultValue: '0.05'
  description: Minimum score for a word to be considered as a keyword between 0 and 1.
  name: keywordMinScore
- auto: PREDEFINED
  defaultValue: macro avg
  description: The metric to use for evaluating the model.
  name: metric
  predefined:
  - micro avg
  - macro avg
  - weighted avgm
- defaultValue: 'true'
  description: Whether to extract keywords for the model. Can be "true" or "false". Default is "true".
  name: findKeywords
  predefined:
  - 'true'
  - 'false'
- auto: PREDEFINED
  defaultValue: 'false'
  description: Whether to return a file that contains the model's predictions on the test set. Can be "true" or "false". Default is "false".
  name: returnPredictionsOnTestSet
  predefined:
  - 'true'
  - 'false'
- defaultValue: emailsubject|name,emailbody|emailbodyhtml
  description: |-
    A comma-separated list of incident fields names with the unprocessed text.
    You can also use "|" if you want to choose the first non-empty value from a list of fields.
  name: originalTextFields
  predefined:
  - ''
- auto: PREDEFINED
  defaultValue: nlp
  description: Text pre-processing type. The default is "json".
  name: preProcessType
  predefined:
  - nlp
  - none
- auto: PREDEFINED
  defaultValue: auto
  description: 'The training algorithm to use for training the model. Default is "auto". If "auto" is selected, the training algorithm will be chosen automatically based on the number of incidents per each label.  Use "from_scratch" to train a new model from scratch, based on your incidents only. In general, "from_scratch" will perform better where the number of incidents is high (500 incidents or more per each verdict). "fine-tune" trains a model based on the out-of-the-box model. "fine-tune" will perform better when the number of incidents is relatively low. It''s possible to train multiple models using different algorithms options, and compare their results.'
  name: trainingAlgorithm
  predefined:
  - auto
  - from_scratch
  - fine_tune
comment: Train a machine learning text classifier.
commonfields:
  id: DBotTrainTextClassifierV2
  version: -1
name: DBotTrainTextClassifierV2
outputs:
- contextPath: DBotPhishingClassifier.ModelName
  description: The model name.
  type: String
- contextPath: DBotPhishingClassifier.EvaluationScores
  description: The model evaluation scores (precision, coverage, etc.) for the found threshold.
  type: Unknown
- contextPath: DBotPhishingClassifier.ConfusionMatrix
  description: The model evaluation confusion matrix for the found threshold.
  type: Unknown
- contextPath: DBotPhishingClassifierNoThresh.EvaluationScores
  description: The model evaluation scores (precision, coverage, etc.) for threshold = 0.
  type: Unknown
- contextPath: DBotPhishingClassifierNoThresh.ConfusionMatrix
  description: The model evaluation confusion matrix for threshold = 0.
  type: Unknown
script: '-'
subtype: python3
tags:
- ml
timeout: 12µs
type: python
dockerimage: demisto/ml:1.0.0.9793547
tests:
- Create Phishing Classifier V2 ML Test
fromversion: 5.0.0
marketplaces:
- xsoar