args:
- description: Additional text by which to query incidents.
  name: query
- defaultValue: Phishing
  description: A comma-separated list of incident types by which to filter.
  name: incidentTypes
- description: 'The start date by which to filter incidents. Date format will be the same as in the incidents query page (valid strings exaple: "3 days ago", ""2019-01-01T00:00:00 +0200").'
  name: fromDate
- description: 'The end date by which to filter incidents. Date format will be the same as in the incidents query page (valid strings exaple: "3 days ago", ""2019-01-01T00:00:00 +0200").'
  name: toDate
- defaultValue: '3000'
  description: The maximum number of incidents to fetch.
  name: limit
- description: The field name with the label. Supports a comma-separated list, the first non-empty value will be taken.
  name: tagField
  required: true
- description: If non-empty, hash every word with this seed.
  name: hashSeed
- defaultValue: '*'
  description: 'A comma-separated list of email tags values and mapping. The script considers only the tags specified in this field. You can map a label to another value by using this format: LABEL:MAPPED_LABEL. For example, for 4 values in email tag: malicious, credentials harvesting, inner communitcation, external legit email, unclassified. While training, we want to ignore "unclassified" tag, and refer to "credentials harvesting" as "malicious" too. Also, we want to merge "inner communitcation" and "external legit email" to one tag called "non-malicious". The input will be: malicious, credentials harvesting:malicious, inner communitcation:non-malicious, external legit email:non-malicious.'
  name: phishingLabels
- description: The model name to store in the system.
  name: modelName
  required: true
- defaultValue: emailsubject
  description: Incident field name with the email subject.
  name: emailsubject
- defaultValue: emailbody
  description: Incident field name with the email body (text).
  name: emailbody
- defaultValue: emailbodyhtml
  description: Incident field name with the email body (html).
  name: emailbodyhtml
- defaultValue: dbotprediction,dbotpredictionprobability
  description: A comma-separated list of fields in the object to poplulate.
  name: populateFields
comment: Apply a trained ML model on multiple incidents at once, to compare incidents how the incidents were labeled by analysts, to the predictions of the model. This script is aimed to help evaluate a trained model using past incidents.
commonfields:
  id: DBotPredictIncidentsBatch
  version: -1
name: DBotPredictIncidentsBatch
script: '-'
subtype: python3
tags:
- phishing
- ml
timeout: '0'
type: python
dockerimage: demisto/pandas:1.0.0.3540678
fromversion: 5.0.0
tests:
- VerifyOOBV2Predictions-Test
- Create Phishing Classifier V2 ML Test
- DbotPredictOufOfTheBoxTestV2