6.2 ‐ How to add ML model files to ESCU

Writing MLTK Content

NOTE: This is specifically for shipping pre trained models. The model files can be created either by leveraging fit command in MLTK or by other custom ML tools

Files needed in a PR

1. In detections/ <detection_name>.yml

• The SPL in this file uses the MLTK apply command

2. In lookups/ directory

• The actual model file ending with <model_name>.mlmodel
• A <lookup_name>.yml file that references the model file:

3. In tests/ <test_name.test>.yml with a reference to a test data set in attack_data repository

Building detection and test yml template files:

python contentctl.py -p . new_content -t detection