FindSimilarIncidentsByText Deprecated

Deprecated. Use DBotFindSimilarIncidents instead. Find similar incidents by text comparison - the algorithm based on TF-IDF method. To read more about this method: https://en.wikipedia.org/wiki/Tf%E2%80%93idf This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Base

Details

ID	`FindSimilarIncidentsByText`
Language	python
From Version	5.0.0
Docker Image	`demisto/sklearn:1.0.0.12545527`
Tags	ml dedup duplicate incidents

README

Find similar incidents by text comparison - the algorithm based on TF-IDF method.
To read more about this method: https://en.wikipedia.org/wiki/Tf%E2%80%93idf

This automation runs using the default Limited User role, unless you explicitly
change the permissions.
For more information, see the section about permissions here:
For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name	Description
Script Type	python3
Tags	ml, dedup, duplicate, incidents
Cortex XSOAR Version	5.0.0

Used In

This script is used in the following playbooks and scripts.

Dedup - Generic
Dedup - Generic v2
Dedup - Generic v3

Inputs

Argument Name	Description
textFields	Text fields to compare. Can be label name, incident fields or custom fields. Comma separated value.
threshold	TFIDF score threshold (to consider incident as similar).
maximumNumberOfIncidents	Maximum number of incidents to check.
timeFrameHours	Check incidents in this time frame.
ignoreClosedIncidents	Ignore close incidents.
timeField	Time field to consider.
maxResults	Maximum number of similar candidates.
minTextLength	Minimum required text length to compare.
preProcessText	Whether to pre-process text (removing HTML, normilize words)

Outputs

Path	Description	Type
similarIncident.rawId	Similar incident ID.	string
isSimilarIncidentFound	Is similar incident found? (true\false)	boolean
similarIncident	Similar incident.	Unknown
similarIncident.name	Similar incident name.	string

Source

FindSimilarIncidentsByText.py FindSimilarIncidentsByText_test.py FindSimilarIncidentsByText.yml

Download History Raw

args:
- defaultValue: name,details
  description: 'Text fields to compare. Can be label name, incident fields or custom fields. Comma separated value. '
  name: textFields
  required: true
- defaultValue: '0.95'
  description: TFIDF score threshold (to consider incident as similar).
  name: threshold
- defaultValue: '1000'
  description: Maximum number of incidents to check.
  name: maximumNumberOfIncidents
- defaultValue: '72'
  description: Check incidents in this time frame.
  name: timeFrameHours
- auto: PREDEFINED
  defaultValue: 'no'
  description: Ignore close incidents.
  name: ignoreClosedIncidents
  predefined:
  - 'yes'
  - 'no'
- auto: PREDEFINED
  defaultValue: occurred
  description: Time field to consider.
  name: timeField
  predefined:
  - occurred
  - created
  - modified
- defaultValue: '10'
  description: Maximum number of similar candidates.
  name: maxResults
- defaultValue: '50'
  description: Minimum required text length to compare.
  name: minTextLength
- auto: PREDEFINED
  defaultValue: 'false'
  description: Whether to pre-process text (removing HTML, normilize words)
  name: preProcessText
  predefined:
  - 'true'
  - 'false'
comment: |-
  Deprecated. Use DBotFindSimilarIncidents instead.
  Find similar incidents by text comparison - the algorithm based on TF-IDF method.
  To read more about this method: https://en.wikipedia.org/wiki/Tf%E2%80%93idf

  This automation runs using the default Limited User role, unless you explicitly
  change the permissions.
  For more information, see the section about permissions here:
  - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
  - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
  - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
commonfields:
  id: FindSimilarIncidentsByText
  version: -1
enabled: true
name: FindSimilarIncidentsByText
outputs:
- contextPath: similarIncident.rawId
  description: Similar incident ID.
  type: string
- contextPath: isSimilarIncidentFound
  description: Is similar incident found? (true\false)
  type: boolean
- contextPath: similarIncident
  description: Similar incident.
  type: Unknown
- contextPath: similarIncident.name
  description: Similar incident name.
  type: string
script: '-'
subtype: python3
tags:
- ml
- dedup
- duplicate
- incidents
timeout: '0'
type: python
dockerimage: demisto/sklearn:1.0.0.12545527
runonce: true
tests:
- No test
fromversion: 5.0.0
deprecated: true