Fortinet white logo
Fortinet white logo

CLI Reference

mlflow

mlflow

Use this command to enable and configure the machine learning flow.

For more information about the Machine Learning Anomaly Detection feature, see the FortiAnalyzer Administration Guide.

Syntax

config system mlflow

set status {enable | disable}

config models

edit <name>

set status {enable | disable}

set model-type {login-anomaly | traffic-download-anomaly | traffic-upload-anomaly}

set train-schedule-range <string>

set train-repeat-at <string>

set train-data-days <integer>

set train-test-days <integer>

set train-test-sensitivity {high | low | medium}

set asset-max-count <integer>

set auto-deploy {enable | disable}

set inference-interval <integer>

set artifact-retention <integer>

set artifact-max-count <integer>

next

end

end

Variable

Description

status {enable | disable}

Enable or disable the Machine Learning Anomaly Detection feature (default = disable).

Variables for config models subcommand:

status {enable | disable}

Default disable, enable to allow training and inference of mlflow related logic for a specific model.

model-type {login-anomaly | traffic-download-anomaly | traffic-upload-anomaly}

Only one of each model-type allowed in config.

train-schedule-range <string>

Use system timezone. Start scheduled training after the start time. End scheduled training after end time.

Training schedule range formats:

  • Continuous training: 'YYYY-MM-DD HH:MM'

    For example: '2025-01-01 00:00'

  • Bounded range: 'YYYY-MM-DD HH:MM -- YYYY-MM-DD HH:MM'

    For example: '2025-01-01 00:00 -- 2026-01-01 00:00'

Default: Start from current time (continuous).

train-repeat-at <string>

Training repeat schedule formats:

  • Daily: 'Daily HH:MM'

    For example: 'Daily 02:00'

  • Weekly: 'Weekly <Day> HH:MM'

    For example: 'Weekly Monday 02:00' or 'Weekly Mon 02:00'

  • Monthly (day of month): 'Monthly <DD> HH:MM'

    For example: 'Monthly 15 02:00' (15th of each month)

  • Monthly (nth weekday): 'Monthly <N> <Day> HH:MM'

    For example: 'Monthly 3 Monday 02:00' (3rd Monday of each month)

  • Interval: '<N>d'

    For example: '7d' (every 7 days)

Default: 7d (train every 7 days since the start time of train-schedule-range).

train-data-days <integer>

Number of days of historical data to use for model training. More training data generally improves model accuracy but increases training time and resource usage (1 - 365, default = 90).

train-test-days <integer>

Number of days used for testing the trained model. Must be less than or equal to train-data-days (1 - 90, default = 7).

During testing, assets that fail to meet the sensitivity criteria are added to the exclusion list.

train-test-sensitivity {high | low | medium}

Training test sensitivity.

  • high: High sensitivity. Uses strict criteria during testing, more assets in exclusion list.

  • low: Low sensitivity. Uses lenient criteria during testing, fewer assets in exclusion list.

  • medium: Medium sensitivity. Balanced testing criteria, moderate asset in exclusion list.

asset-max-count <integer>

Maximum number of assets to track. Assets include endusers and endpoints depending on the model type. Higher values require more memory and processing resources (100 - 100000, default = 1000).

auto-deploy {enable | disable}

Deploy artifact automatically when model is trained on schedule.

inference-interval <integer>

Inference interval in minutes (1 - 1440, default = 20).

Defines how frequently the model analyzes new data for anomalies. Shorter intervals provide faster detection but use more resources.

Recommended values by model type:

  • login-anomaly: 20 minutes

  • traffic-download-anomaly: 60 minutes (must be multiple of 60)

  • traffic-upload-anomaly: 60 minutes (must be multiple of 60)

Traffic models require inference-interval to be a multiple of 60.

artifact-retention <integer>

Artifact retention period in days (1 - 365, default = 30).

Artifacts older than this period are automatically deleted. The most recent artifact-max-count artifacts are always retained regardless of age.

artifact-max-count <integer>

Maximum number of artifacts to retain per model (1 - 100, default = 10).

Older artifacts beyond this count are deleted automatically. This limit is enforced regardless of artifact-retention setting.

mlflow

mlflow

Use this command to enable and configure the machine learning flow.

For more information about the Machine Learning Anomaly Detection feature, see the FortiAnalyzer Administration Guide.

Syntax

config system mlflow

set status {enable | disable}

config models

edit <name>

set status {enable | disable}

set model-type {login-anomaly | traffic-download-anomaly | traffic-upload-anomaly}

set train-schedule-range <string>

set train-repeat-at <string>

set train-data-days <integer>

set train-test-days <integer>

set train-test-sensitivity {high | low | medium}

set asset-max-count <integer>

set auto-deploy {enable | disable}

set inference-interval <integer>

set artifact-retention <integer>

set artifact-max-count <integer>

next

end

end

Variable

Description

status {enable | disable}

Enable or disable the Machine Learning Anomaly Detection feature (default = disable).

Variables for config models subcommand:

status {enable | disable}

Default disable, enable to allow training and inference of mlflow related logic for a specific model.

model-type {login-anomaly | traffic-download-anomaly | traffic-upload-anomaly}

Only one of each model-type allowed in config.

train-schedule-range <string>

Use system timezone. Start scheduled training after the start time. End scheduled training after end time.

Training schedule range formats:

  • Continuous training: 'YYYY-MM-DD HH:MM'

    For example: '2025-01-01 00:00'

  • Bounded range: 'YYYY-MM-DD HH:MM -- YYYY-MM-DD HH:MM'

    For example: '2025-01-01 00:00 -- 2026-01-01 00:00'

Default: Start from current time (continuous).

train-repeat-at <string>

Training repeat schedule formats:

  • Daily: 'Daily HH:MM'

    For example: 'Daily 02:00'

  • Weekly: 'Weekly <Day> HH:MM'

    For example: 'Weekly Monday 02:00' or 'Weekly Mon 02:00'

  • Monthly (day of month): 'Monthly <DD> HH:MM'

    For example: 'Monthly 15 02:00' (15th of each month)

  • Monthly (nth weekday): 'Monthly <N> <Day> HH:MM'

    For example: 'Monthly 3 Monday 02:00' (3rd Monday of each month)

  • Interval: '<N>d'

    For example: '7d' (every 7 days)

Default: 7d (train every 7 days since the start time of train-schedule-range).

train-data-days <integer>

Number of days of historical data to use for model training. More training data generally improves model accuracy but increases training time and resource usage (1 - 365, default = 90).

train-test-days <integer>

Number of days used for testing the trained model. Must be less than or equal to train-data-days (1 - 90, default = 7).

During testing, assets that fail to meet the sensitivity criteria are added to the exclusion list.

train-test-sensitivity {high | low | medium}

Training test sensitivity.

  • high: High sensitivity. Uses strict criteria during testing, more assets in exclusion list.

  • low: Low sensitivity. Uses lenient criteria during testing, fewer assets in exclusion list.

  • medium: Medium sensitivity. Balanced testing criteria, moderate asset in exclusion list.

asset-max-count <integer>

Maximum number of assets to track. Assets include endusers and endpoints depending on the model type. Higher values require more memory and processing resources (100 - 100000, default = 1000).

auto-deploy {enable | disable}

Deploy artifact automatically when model is trained on schedule.

inference-interval <integer>

Inference interval in minutes (1 - 1440, default = 20).

Defines how frequently the model analyzes new data for anomalies. Shorter intervals provide faster detection but use more resources.

Recommended values by model type:

  • login-anomaly: 20 minutes

  • traffic-download-anomaly: 60 minutes (must be multiple of 60)

  • traffic-upload-anomaly: 60 minutes (must be multiple of 60)

Traffic models require inference-interval to be a multiple of 60.

artifact-retention <integer>

Artifact retention period in days (1 - 365, default = 30).

Artifacts older than this period are automatically deleted. The most recent artifact-max-count artifacts are always retained regardless of age.

artifact-max-count <integer>

Maximum number of artifacts to retain per model (1 - 100, default = 10).

Older artifacts beyond this count are deleted automatically. This limit is enforced regardless of artifact-retention setting.