Machine Learning
Help to manage machine learning models in Cortex.
Machine Learning
- Details
- Content
- Dependencies
- Version History
Help to manage machine learning models in Cortex XSOAR
Automations
| Name | Description |
|---|---|
| HashIncidentsFields | Hash fields from the incident list. |
| ExtendQueryBasedOnPhishingLabels | A helper script for the DBot Create Phishing Classifier V2 playbook. This script extends the query based on the phishingLabels argument. |
| DBotPredictOutOfTheBoxV2 | Predict phishing incidents using the out-of-the-box pre-trained model. |
| ExportMLModel | Exports an existing ML model to a file. |
| ImportMLModel | Imports a file that contains an ML model. |
| EvaluateMLModllAtProduction | Evaluates an ML model in production. |
| DBotPredictIncidentsBatch | Apply a trained ML model on multiple incidents at once, to compare incidents how the incidents were labeled by analysts, to the predictions of the model. This script is aimed to help evaluate a trained model using past incidents. |
DBotPredictOutOfTheBox | Deprecated. Use DBotPredictOutOfTheBoxV2 instead. |
Playbooks
| Name | Description |
|---|---|
| DBot Create Phishing Classifier V2 Job | Train the phishing machine learning model. This playbook should be used as job, to run repeatedly, for example every week. |
| DBot Create Phishing Classifier V2 | Create a phishing classifier using machine learning techniques, based on email content. |
DBot Create Phishing Classifier V2 From File | Create a phishing classifier using machine learning. The classifier is based on incidents files extracted from email content. |
Required Content Packs (2)
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
Optional Content Packs (0)
| Pack Name | Pack By |
|---|
All level dependencies (4)
| Pack Name | Pack By |
|---|---|
| Common Scripts | By: Cortex XSOAR |
| Base | By: Cortex XSOAR |
| Aggregated Scripts | By: Cortex XSOAR |
| Cortex REST API | By: Cortex XSOAR |
1.4.23 - 4096037 (July 8, 2025)
1.4.21 - 3720941 (June 10, 2025)
- 38644
Download
Scripts
DBotPredictOutOfTheBoxV2
- Updated the Docker image to: demisto/ml:1.0.0.3261948.
DBotPredictIncidentsBatch
Breaking changes: Before using this version, sure to update the Base pack to the latest version.
- Updated the Docker image to: demisto/pandas:1.0.0.3540678.
- 38644
Download
1.4.20 - R3414854 (May 15, 2025)
- 39132
Download
Scripts
ExportMLModel
- Metadata and documentation improvements.
DBotPredictOutOfTheBoxV2
- Metadata and documentation improvements.
ImportMLModel
- Metadata and documentation improvements.
EvaluateMLModllAtProduction
- Metadata and documentation improvements.
ExtendQueryBasedOnPhishingLabels
- Metadata and documentation improvements.
HashIncidentsFields
- Metadata and documentation improvements.
DBotPredictIncidentsBatch
- Metadata and documentation improvements.
- 39132
Download
1.4.16 - 1718057 (November 28, 2024)
- 37407
- 37402
- 37403
- 37405
- 37406
- 37404
Download
Scripts
ExportMLModel
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ImportMLModel
- Updated the Docker image to: demisto/python3:3.11.10.115186.
HashIncidentsFields
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ExtendQueryBasedOnPhishingLabels
- Updated the Docker image to: demisto/python3:3.11.10.115186.
- 37407
- 37402
- 37403
- 37405
- 37406
- 37404
Download
1.4.11 - 1169083 (July 11, 2024)
1.4.9 - 752611 (January 9, 2024)
1.4.8 - 6035467 (August 13, 2023)
1.4.6 - 5731243 (July 10, 2023)
1.4.5 - R5692327 (July 5, 2023)
1.4.4 - R4718798 (March 1, 2023)
- 23844
Download
Scripts
ExtendQueryBasedOnPhishingLabels
- Fixed an issue where custom labels resulted in an error.
- Updated the Docker image to: demisto/python3:3.10.9.46032.
EvaluateMLModllAtProduction
- Fixed an issue where custom labels resulted in an error.
- Updated the Docker image to: demisto/ml:1.0.0.45981.
DBotPredictIncidentsBatch
- Fixed an issue where custom labels resulted in an error.
- Updated the Docker image to: demisto/ml:1.0.0.45981.
- 23844
Download
1.4.1 - 2745974 (April 12, 2022)
Scripts
HashIncidentsFields
- Updated the Docker image to: demisto/python3:3.10.4.27798.
- Fixed lint issues.
1.4.0 - 2419785 (February 15, 2022)
Playbooks
DBot Create Phishing Classifier V2
Improved memory usage while fetching incidents for training.
Scripts
New: ExtendQueryBasedOnPhishingLabels
A helper script for the DBot Create Phishing Classifier V2 playbook. This script extends the query based on the phishingLabels argument. (Available from Cortex XSOAR 5.0.0).
1.3.7 - R2238421 (January 11, 2022)
Scripts
HashIncidentsFields
- Updated the Docker image to: demisto/python3:3.9.8.24399.
PUBLISHER
PLATFORMS
Cortex XSOAR
INFO
| Certification | Certified | Read more |
| Supported By | Cortex | |
| Created | June 30, 2020 | |
| Last Release | January 21, 2026 |