FP/FN Negation: callback_phishing_nlu_body_or_attachments.yml (#750)

sublime-security · Sep 8, 2023 · 0465b64 · 0465b64
1 parent 71409e9
commit 0465b64
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/detection-rules/callback_phishing_nlu_body_or_attachments.yml b/detection-rules/callback_phishing_nlu_body_or_attachments.yml
@@ -15,7 +15,9 @@ source: |
         )
     )
     or any(ml.nlu_classifier(body.current_thread.text).intents,
-           .name in ("callback_scam") and .confidence == "high"
+           .name in ("callback_scam")
+           and .confidence == "high"
+           and length(body.current_thread.text) < 1500
     )
   )
   and not (