Devo SOAR - combineScores

Combine scores using a trained model from the createScoreCombiner operator.
Trained models are not displayed in the UI, so remember the name of the model that was created.

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter Combine Scores operator in the search field and select the operator from the Results to open the operator form.
3. In the Table drop-down, enter or select the table to apply to an operator.
4. In the Model Path drop-down, enter or select the location of a model that was built using CreateScoreCombiner.
5. Click Run to view the result.
6. Click Save to add the operator to the playbook.
7. Click Cancel to discard the operator form.

Usage Details

LQL Command

combineScores(table, modelFilename, scoreFields*)

Input
table: Name of a table that contains scoreFields to combine them and get a final score.
modelFilename: Name of a model filename stored in a disk.
scoreFields: List of field names for scores to combine. The order must be the same as the order that was used ib training the model.

Output
The lhub_score column is added to the table. It is a real number between 0.0 and 10.0.

Example

Model name downloadAndLoginScorer, which was created using the createScoreCominber operator.

LQL command

combineScores(table, "downloadAndLoginScorer", "downloadScore", "loginScore")

Output