Skip to content
Manage Predictive Intelligence for User Reported Phishing › Security Incident Response › Enterprise security case management applications › Security Operations
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Required components and plugins

To use Predictive Intelligence for User Reported Phishing, you must install the following applications

Plugin nameMinimum version
Security Incident Response9.0.1 or 10.0.2
Predictive IntelligenceOrlando version
Predictive Intelligence for User Reported Phishing10.0.2

Note: The following new enhancements are available with Security Incident Response 10.4:

  • The ability to choose close codes from custom fields for model training.
  • The ability to explicitly activate predictions after model building.
  • The ability to generate a final verdict on the User Reported Phishing submission using a decision table. (requires Security Operations Spoke 10.3.0)

To use the new enhancements, you must upgrade the following applications:

Plugin nameUpgrade to
Security Incident Response10.0.4
Predictive Intelligence for User Reported Phishing10.3.1

New and updated tables

  • sn_sir_ml_urp_config (New): Contains the configuration for the URP ML application.
  • sn_sir_ml_urp_feature (New): Records extracted from the sn_si_phishing email table.
  • sn_sir_ml_urp_feature_import (New): Used to upload historical phishing email data.
  • sn_si_incident (updated): The following new fields were added:
    • Prediction accepted
    • Prediction result
    • Confidence score
  • Script includes
    • URPMLUtil: Retrieves configuration, run prediction job, and track prediction process.
    • URPMLProcessor: Extracts and processes data from the sn_si_phishing_email table.
    • URPMLAction: Executes flow to accept prediction result.