mlflow
Use this command to enable and configure the machine learning flow.
For more information about the Machine Learning Anomaly Detection feature, see the FortiAnalyzer Administration Guide.
Syntax
config system mlflow
set status {enable | disable}
config models
edit <name>
set status {enable | disable}
set model-type {login-anomaly | traffic-download-anomaly | traffic-upload-anomaly}
set train-schedule-range <string>
set train-repeat-at <string>
set train-data-days <integer>
set train-test-days <integer>
set train-test-sensitivity {high | low | medium}
set asset-max-count <integer>
set auto-deploy {enable | disable}
set inference-interval <integer>
set artifact-retention <integer>
set artifact-max-count <integer>
next
end
end
|
Variable |
Description |
|---|---|
|
status {enable | disable} |
Enable or disable the Machine Learning Anomaly Detection feature (default = disable). |
|
Variables for |
|
|
status {enable | disable} |
Default disable, enable to allow training and inference of mlflow related logic for a specific model. |
|
model-type {login-anomaly | traffic-download-anomaly | traffic-upload-anomaly} |
Only one of each model-type allowed in config. |
|
train-schedule-range <string> |
Use system timezone. Start scheduled training after the start time. End scheduled training after end time. Training schedule range formats:
Default: Start from current time (continuous). |
|
train-repeat-at <string> |
Training repeat schedule formats:
Default: |
|
train-data-days <integer> |
Number of days of historical data to use for model training. More training data generally improves model accuracy but increases training time and resource usage (1 - 365, default = 90). |
|
train-test-days <integer> |
Number of days used for testing the trained model. Must be less than or equal to train-data-days (1 - 90, default = 7). During testing, assets that fail to meet the sensitivity criteria are added to the exclusion list. |
|
train-test-sensitivity {high | low | medium} |
Training test sensitivity.
|
|
asset-max-count <integer> |
Maximum number of assets to track. Assets include endusers and endpoints depending on the model type. Higher values require more memory and processing resources (100 - 100000, default = 1000). |
|
auto-deploy {enable | disable} |
Deploy artifact automatically when model is trained on schedule. |
|
inference-interval <integer> |
Inference interval in minutes (1 - 1440, default = 20). Defines how frequently the model analyzes new data for anomalies. Shorter intervals provide faster detection but use more resources. Recommended values by model type:
Traffic models require inference-interval to be a multiple of 60. |
|
artifact-retention <integer> |
Artifact retention period in days (1 - 365, default = 30). Artifacts older than this period are automatically deleted. The most recent artifact-max-count artifacts are always retained regardless of age. |
|
artifact-max-count <integer> |
Maximum number of artifacts to retain per model (1 - 100, default = 10). Older artifacts beyond this count are deleted automatically. This limit is enforced regardless of artifact-retention setting. |