args:
- description: Incident ID to get the prediction of. If empty, predicts the the current incident ID.
  name: incidentId
- auto: PREDEFINED
  description: 'Comma-separated list of incident text fields to take into account when computing similarity. For example: commandline, URL. Note: In order to calculate similarity, fields must consist of a minimum of 2 letters.'
  name: similarTextField
- auto: PREDEFINED
  description: 'Comma-separated list of incident categorical fields to take into account whe computing similarity. For example: IP, URL. Note: In order to calculate similarity, fields must consist of a minimum of 2 letters.'
  name: similarCategoricalField
- auto: PREDEFINED
  description: 'Comma-separated list of incident JSON fields to take into account whe computing similarity. For example: CustomFields. Note: In order to calculate similarity, fields must consist of a minimum of 2 letters.'
  name: similarJsonField
- auto: PREDEFINED
  description: Comma-separated list of additional incident fields to display, but which will not be taken into account when computing similarity.
  name: fieldsToDisplay
- auto: PREDEFINED
  description: Comma-separated list of incident fields that have to be equal to the current incident fields. This helps reduce the query size. These fields are not part of the similarity calculation.
  name: fieldExactMatch
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to use a predefined set of fields and custom fields to compute similarity. If "True", it will ignore values in similarTextField, similarCategoricalField, similarJsonField.
  name: useAllFields
  predefined:
  - 'True'
  - 'False'
- defaultValue: 1 months ago
  description: The start date by which to filter incidents. Date format will be the same as in the incidents query page, for example, "3 days ago", ""2019-01-01T00:00:00 +0200").
  name: fromDate
- description: The end date by which to filter incidents. Date format will be the same as in the incidents query page, for example, "3 days ago", ""2019-01-01T00:00:00 +0200").
  name: toDate
- description: Argument for the query. This helps reduce the query size.
  name: query
- defaultValue: '1500'
  description: The maximum number of incidents to query.
  name: limit
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to aggregate duplicate incidents within diffrerent dates.
  name: aggreagateIncidentsDifferentDate
  predefined:
  - 'True'
  - 'False'
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to display the similarity score for each of the incident fields.
  name: showIncidentSimilarityForAllFields
  predefined:
  - 'True'
  - 'False'
- defaultValue: '0.2'
  description: Retain incidents with similarity score that's higher than the MinimunIncidentSimilarity.
  name: minimunIncidentSimilarity
- defaultValue: '100'
  description: The maximum number of incidents to display.
  name: maxIncidentsToDisplay
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to display the current incident.
  name: showCurrentIncident
  predefined:
  - 'True'
  - 'False'
- auto: PREDEFINED
  defaultValue: 'False'
  description: Whether to include similarity of indicators from DBotFindSimilarIncidentsByIndicators in the final score.
  name: includeIndicatorsSimilarity
  predefined:
  - 'True'
  - 'False'
- description: The minimum number of indicators required related to the incident before running the model. Relevant if includeIndicatorsSimilarity is "True".
  name: minNumberOfIndicators
- auto: PREDEFINED
  description: Comma-separated list of indicator types to take into account. If empty, uses all indicators types. Relevant if includeIndicatorsSimilarity is "True".
  name: indicatorsTypes
- description: Help to filter out indicators that appear in many incidents. Relevant if includeIndicatorsSimilarity is "True".
  name: maxIncidentsInIndicatorsForWhiteList
comment: |-
  Finds past similar incidents based on incident fields' similarity. Includes an option to also display indicators similarity.
  Note: For the similarity calculation, at least one field must be provided in one of the "similarTextField", "similarCategoricalField", or "similarJsonField" arguments.
commonfields:
  id: DBotFindSimilarIncidents
  version: -1
enabled: true
name: DBotFindSimilarIncidents
script: '-'
subtype: python3
timeout: '0'
type: python
dockerimage: demisto/sklearn:1.0.0.12545527
runas: DBotWeakRole
tests:
- DBotFindSimilarIncidents-test
fromversion: 5.0.0
outputs:
- contextPath: DBotFindSimilarIncidents.isSimilarIncidentFound
  description: Indicates whether similar incidents have been found.
  type: boolean
- contextPath: DBotFindSimilarIncidents.similarIncident.created
  description: The creation date of the linked incident.
  type: date
- contextPath: DBotFindSimilarIncidents.similarIncident.id
  description: The ID of the linked incident.
  type: string
- contextPath: DBotFindSimilarIncidents.similarIncident.name
  description: The name of the linked incident.
  type: string
- contextPath: DBotFindSimilarIncidents.similarIncident.similarity incident
  description: The similarity of the linked incident represented as a float in the range 0-1.
  type: number
- contextPath: DBotFindSimilarIncidents.similarIncident.details
  description: The details of the linked incident.
  type: string
autoUpdateDockerImage: false