From 0465b64954bdfe4808c38d837edbfe88187eb19d Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Fri, 8 Sep 2023 14:19:27 -0400 Subject: [PATCH] FP/FN Negation: callback_phishing_nlu_body_or_attachments.yml (#750) --- detection-rules/callback_phishing_nlu_body_or_attachments.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-rules/callback_phishing_nlu_body_or_attachments.yml b/detection-rules/callback_phishing_nlu_body_or_attachments.yml index d45d5fa596f..2eaa5c00728 100644 --- a/detection-rules/callback_phishing_nlu_body_or_attachments.yml +++ b/detection-rules/callback_phishing_nlu_body_or_attachments.yml @@ -15,7 +15,9 @@ source: | ) ) or any(ml.nlu_classifier(body.current_thread.text).intents, - .name in ("callback_scam") and .confidence == "high" + .name in ("callback_scam") + and .confidence == "high" + and length(body.current_thread.text) < 1500 ) ) and not (