Feedback:

Send email

fit OrdinalEncoder

Use OrdinalEncoder to encode categorical features into integer-encoded vector representations.

Each unique category is mapped to a distinct integer, producing a compact numeric form that can be consumed by downstream analytics, detection logic, or machine learning models.

Syntax

| fit OrdinalEncoder [handle_unknown={'error'|'use_encoded_value'}] [unknown_value=<int>] [encoded_missing_value=<int>] <categorical_fields> [into '<model_name>']

handle_unknown

(Optional) Controls how the encoder behaves when it encounters a category during transformation that was not observed during fitting.

use_encoded_value: Default value. Unknown categories are mapped to a predefined integer.

error: Transformation fails if an unknown category is encountered.
unknown_value (Optional) Specifies the integer value used to encode previously unseen categories. Default value is -1.
encoded_missing_value

(Optional) Specifies the integer value used to encode missing or null categories. Default value is -2.
categorical_fields Each field is encoded independently, producing one integer column per input field.
into '<model_name>' Persists the learned category-to-integer mapping into a named model object.

Usage

You can use OrdinalEncoder to encode categorical features as an vector of integers. It is particularly useful when you need a stable, low-dimensional representation of categorical data.

As an example, in cybersecurity workflows, ordinal encoding can be applied to fields such as:

  • action: ALLOW, DENY, BLOCK

  • priority: low, medium, high

  • event_type: login, file access, process start

  • authentication_method: password, token, certificate

  • device_type

In terms of real-world applications, it is especially effective for:

  • UEBA feature pipelines

  • Event classification

  • Alert enrichment

  • Log normalization prior to ML scoring

How OrdinalEncoder works

Ordinal encoding assigns arbitrary integer IDs to categories based on the order in which categories are encountered during fitting.

  • It creates a consistent numeric mapping for categorical values.

  • It preserves category identity, not semantic distance.

  • It does not imply ranking, magnitude, or priority between categories, unless the original featurse are inherently ordinal.

  • The transformation does not enfore semantic ordering unless the original features are truly ordinal, that is, they have inherent ordering.

For example, the following encoding does not mean BLOCK > DENY > ALLOW in severity or importance:

Copy 
ALLOW = 0
DENY = 1
BLOCK = 2

However, an inherent order does exist in the following encoding for high priority compared to low priority since priority has inherent ordering:

Copy 
low = 0
medium = 1
high = 2

Such encoding helps tree-based models such as IsolationForest to make meaningful decision splits like priority >= medium, but should not be used for distance-based models to assume numeric spacing for arithmetic expressions such as high - medium == medium - low.

Examples

| fit ordinalencoder handle_unknown='use_encoded_value' unknown_value=-2 encoded_missing_value=-1 action

 

| fit ordinalencoder action into 'model_name'