> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/machine-learning-models.md).

# Machine Learning Models

Machine learning models enable Cortex XSOAR to analyze and predict behavior through incident types and fields. The model uses past incidents that have already been classified to classify incoming events automatically.

Machine learning models are used mainly for phishing incidents. You can train it to automatically recognize, for example, phishing emails, emails that are legitimate, and those that contain Spam.

Machine learning models enable you to do the following:

* Use as part of a scoring/severity set.
* To close incidents automatically more accurately than manually defining a threshold.
* Handle only incidents that the classifier marks as malicious.

You train models by inputting data through incident types and fields. Cortex XSOAR returns all the incidents containing the specified field. You can then map these field values into different verdicts. The verdicts determine what the model predicts, so you should make the verdict definitions meaningful.

By default, Cortex XSOAR trains models from input data contained in an Email body, Email HTML, and Email subject. You can change the name of the fields containing the subject and body. Cortex XSOAR then trains a model and returns the accuracy of the model against each category.

To create a machine learning model, see [Create a Machine Learning Model](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/create-a-machine-learning-model.md). You can use the [Phishing Classifier Demo](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/phishing-classifier-demo.md) to see how machine learning works in practice and then create your own model. You need to install the [Machine Learning](https://xsoar.pan.dev/marketplace/details/ML) content pack to use the demo and the playbooks which can help to train the model.

The machine learning model for phishing can be used as following:

* Part of the **Phishing - Generic v3** playbook, when adding the **`DbotPredictPhishingWords`** command, or when creating a playbook.

  When Cortex XSOAR runs the playbook it takes the machine learning model that you have defined.
* Run the **`!DbotPredictPhishingWords`** command in the War Room or in the Machine Learning page, by typing: **`!DbotPredictPhishingWords modelName="name" emailBody="body"emailbodyhtml=”email body html” emailsubject=”email subject”`**. For more information, see [Phishing Command Examples Using a Machine Learning Model](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/create-a-machine-learning-model.md#UUID-5d6bf90e-ec9f-fe3f-d182-ceeabfbfec87).

  You can [Use the Phishing Classifier in Production](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/use-the-phishing-classifier-in-production.md) and run a [phishing classifier demo](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/phishing-classifier-demo.md), without the need to create a machine learning model.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/machine-learning-models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.