Machine Learning - Model Profiles 🆕

Note

ML Model Profiles define different machine learning models used for anomaly detection in user sessions. Each profile targets specific protocols and behavior patterns:

• Semantic_Behavioral - Analyzes command patterns in SSH sessions

• Mouse_Biometric - Tracks mouse movement patterns in RDP sessions

• Keyboard_Biometric - Monitors typing patterns in RDP sessions

Data Structures

MLModelProfileModel

Attribute	Type	Required	Description
id	string		Read-only. Unique ID of machine learning model profile.
name	string		Read-only. Profile name (e.g., Semantic_Behavioral, Mouse_Biometric).
active	boolean		Read-only. Whether the profile is enabled for scoring.
ml_model	number		Read-only. ID of the currently active ML model for this profile.
protocol	string		Read-only. Protocol this profile applies to (ssh, rdp, etc.).
training_time	string		Read-only. Expensive to use. Time spent training the current model (seconds).
session_segments_used	string		Read-only. Expensive to use. Number of session segments used for training.
entities_covered	number		Read-only. Expensive to use. Number of entities covered by the model.
tpr	string		Read-only. Expensive to use. True positive rate of the model (0.0 to 1.0).
fpr	string		Read-only. Expensive to use. False positive rate of the model (0.0 to 1.0).
auroc	string		Read-only. Expensive to use. Area under ROC curve (0.0 to 1.0, higher is better).
trained_at	string		Read-only. Expensive to use. Timestamp when the model was trained.

Retrieve Available Attributes of the MLModelProfileModel

Request

Method	GET
Path	/api/v2/objspec/ml_model_profile

GET /api/v2/objspec/ml_model_profile

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/objspec/ml_model_profile'

List ML Model Profiles

Retrieve all available machine learning model profiles.

Request

Method	GET
Path	/api/v2/ml/profile

GET /api/v2/ml/profile

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/ml/profile'

Response

{
    "result": "success",
    "ml_model_profile": [
        {
            "id": "5980780305148018689",
            "name": "Semantic_Behavioral",
            "active": true,
            "ml_model": 5980780305148018733,
            "protocol": "ssh",
            "training_time": "91.651764",
            "session_segments_used": "5400",
            "entities_covered": 6,
            "tpr": "1",
            "fpr": "0",
            "auroc": "1",
            "trained_at": "2026-06-08 08:49:59.795649-07"
        },
        {
            "id": "5980780305148018690",
            "name": "Mouse_Biometric",
            "active": true,
            "ml_model": 5980780305148018731,
            "protocol": "rdp",
            "training_time": "14.345926",
            "session_segments_used": "2357",
            "entities_covered": 12,
            "tpr": "0.9293527",
            "fpr": "0.029565375",
            "auroc": "0.98550755",
            "trained_at": "2026-06-08 08:46:47.652581-07"
        },
        {
            "id": "5980780305148018691",
            "name": "Keyboard_Biometric",
            "active": true,
            "ml_model": 5980780305148018732,
            "protocol": "rdp",
            "training_time": "12.508921",
            "session_segments_used": "2189",
            "entities_covered": 11,
            "tpr": "0.8636141",
            "fpr": "0.039960314",
            "auroc": "0.95361376",
            "trained_at": "2026-06-08 08:47:23.623124-07"
        }
    ]
}

Disable ML Model Profile

Disable a specific ML model profile to stop it from scoring new sessions.

Request

Method	POST
Path	/api/v2/ml/profile/<id>/disable

POST /api/v2/ml/profile/<id>/disable

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/ml/profile/5980780305148018691/disable'

Success Response

{
    "result": "success"
}

Enable ML Model Profile

Enable a previously disabled ML model profile to resume scoring sessions.

Request

Method	POST
Path	/api/v2/ml/profile/<id>/enable

POST /api/v2/ml/profile/<id>/enable

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/ml/profile/5980780305148018691/enable'

Success Response

{
    "result": "success"
}