First batch of NLU signals (#501)

Co-authored-by: Cameron Dunn <[email protected]> Co-authored-by: Sam Scholten <[email protected]> Co-authored-by: Sam Scholten <[email protected]>
sublime-security · Oct 6, 2023 · a50d0c5 · a50d0c5
1 parent 32cb236
commit a50d0c5
Show file tree

Hide file tree

Showing 35 changed files with 251 additions and 0 deletions.
diff --git a/signals/content/nlu_bec_high_conf.yml b/signals/content/nlu_bec_high_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Business Email Compromise - High Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec" and .confidence == "high")
+tags:
+  - "Natural Language Understanding"
+  - "Business Email Compromise"
diff --git a/signals/content/nlu_bec_low_conf.yml b/signals/content/nlu_bec_low_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Business Email Compromise - Low Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec" and .confidence == "low")
+tags:
+  - "Natural Language Understanding"
+  - "Business Email Compromise"
diff --git a/signals/content/nlu_bec_med_conf.yml b/signals/content/nlu_bec_med_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Business Email Compromise - Medium Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec" and .confidence == "medium")
+tags:
+  - "Natural Language Understanding"
+  - "Business Email Compromise"
diff --git a/signals/content/nlu_callback_scam_high_conf.yml b/signals/content/nlu_callback_scam_high_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Callback Scam - High Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "callback_scam" and .confidence == "high")
+tags:
+  - "Natural Language Understanding"
+  - "Callback Scam"
diff --git a/signals/content/nlu_callback_scam_low_conf.yml b/signals/content/nlu_callback_scam_low_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Callback Scam - Low Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "callback_scam" and .confidence == "low")
+tags:
+  - "Natural Language Understanding"
+  - "Callback Scam"
diff --git a/signals/content/nlu_callback_scam_medium_conf.yml b/signals/content/nlu_callback_scam_medium_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Callback Scam - Medium Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "callback_scam" and .confidence == "medium")
+tags:
+  - "Natural Language Understanding"
+  - "Callback Scam"
diff --git a/signals/content/nlu_credtheft_high_conf.yml b/signals/content/nlu_credtheft_high_conf.yml
@@ -0,0 +1,8 @@
+name: "NLU Intent: Credential Theft - High Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "cred_theft" and .confidence == "high")
+severity: "medium"
+tags:
+  - "Natural Language Understanding"
+  - "Credential Theft"
diff --git a/signals/content/nlu_credtheft_low_conf.yml b/signals/content/nlu_credtheft_low_conf.yml
@@ -0,0 +1,8 @@
+name: "NLU Intent: Credential Theft - Low Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "cred_theft" and .confidence == "low")
+severity: "medium"
+tags:
+  - "Natural Language Understanding"
+  - "Credential Theft"
diff --git a/signals/content/nlu_credtheft_med_conf.yml b/signals/content/nlu_credtheft_med_conf.yml
@@ -0,0 +1,8 @@
+name: "NLU Intent: Credential Theft - Medium Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "cred_theft" and .confidence == "medium")
+severity: "medium"
+tags:
+  - "Natural Language Understanding"
+  - "Credential Theft"
diff --git a/signals/content/nlu_extortion_high_conf.yml b/signals/content/nlu_extortion_high_conf.yml
@@ -0,0 +1,8 @@
+name: "NLU Intent: Extortion - High Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "extortion" and .confidence == "high")
+severity: "medium"
+tags:
+  - "Natural Language Understanding"
+  - "Extortion"
diff --git a/signals/content/nlu_extortion_low_conf.yml b/signals/content/nlu_extortion_low_conf.yml
@@ -0,0 +1,8 @@
+name: "NLU Intent: Extortion - Low Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "extortion" and .confidence == "low")
+severity: "medium"
+tags:
+  - "Natural Language Understanding"
+  - "Extortion"
diff --git a/signals/content/nlu_extortion_med_conf.yml b/signals/content/nlu_extortion_med_conf.yml
@@ -0,0 +1,8 @@
+name: "NLU Intent: Extortion  - Medium Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "extortion" and .confidence == "medium")
+severity: "medium"
+tags:
+  - "Natural Language Understanding"
+  - "Extortion"
diff --git a/signals/content/nlu_financial_entity.yml b/signals/content/nlu_financial_entity.yml
@@ -0,0 +1,7 @@
+name: "NLU Entity: Financial"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "financial")
+tags:
+  - "Natural Language Understanding"
+
diff --git a/signals/content/nlu_greeting_entity.yml b/signals/content/nlu_greeting_entity.yml
@@ -0,0 +1,7 @@
+name: "NLU Entity: Greeting"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "greeting")
+tags:
+  - "Natural Language Understanding"
+
diff --git a/signals/content/nlu_invoice_high_conf.yml b/signals/content/nlu_invoice_high_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Tag: Invoice - High Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "invoice" and .confidence == "high")
+tags:
+  - "Natural Language Understanding"
+  - "Invoice"
diff --git a/signals/content/nlu_invoice_low_conf.yml b/signals/content/nlu_invoice_low_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Tag: Invoice - Low Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "invoice" and .confidence == "low")
+tags:
+  - "Natural Language Understanding"
+  - "Invoice"
diff --git a/signals/content/nlu_invoice_medium_conf.yml b/signals/content/nlu_invoice_medium_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Tag: Invoice - Medium Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "invoice" and .confidence == "medium")
+tags:
+  - "Natural Language Understanding"
+  - "Invoice"
diff --git a/signals/content/nlu_job_scam_high_conf.yml b/signals/content/nlu_job_scam_high_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Job Scam - High Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "job_scam" and .confidence == "high")
+tags:
+  - "Natural Language Understanding"
+  - "Job Scam"
diff --git a/signals/content/nlu_job_scam_low_conf.yml b/signals/content/nlu_job_scam_low_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Job Scam - Low Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "job_scam" and .confidence == "low")
+tags:
+  - "Natural Language Understanding"
+  - "Job Scam"
diff --git a/signals/content/nlu_job_scam_medium_conf.yml b/signals/content/nlu_job_scam_medium_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Job Scam - Medium Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "job_scam" and .confidence == "medium")
+tags:
+  - "Natural Language Understanding"
+  - "Job Scam"
diff --git a/signals/content/nlu_org_entity.yml b/signals/content/nlu_org_entity.yml
@@ -0,0 +1,7 @@
+name: "NLU Entity: Organization"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "org")
+tags:
+  - "Natural Language Understanding"
+
diff --git a/signals/content/nlu_payment_high_conf.yml b/signals/content/nlu_payment_high_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Tag: Payment - High Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "payment" and .confidence == "high")
+tags:
+  - "Natural Language Understanding"
+  - "Payment"
diff --git a/signals/content/nlu_payment_low_conf.yml b/signals/content/nlu_payment_low_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Tag: Payment - Low Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "payment" and .confidence == "low")
+tags:
+  - "Natural Language Understanding"
+  - "Payment"
diff --git a/signals/content/nlu_payment_medium_conf.yml b/signals/content/nlu_payment_medium_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Tag: Payment - Medium Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "payment" and .confidence == "medium")
+tags:
+  - "Natural Language Understanding"
+  - "Payment"
diff --git a/signals/content/nlu_purchase_order_high_conf.yml b/signals/content/nlu_purchase_order_high_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Tag: Purchase Order - High Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "purchase_order" and .confidence == "high")
+tags:
+  - "Natural Language Understanding"
+  - "Purchase Order"
diff --git a/signals/content/nlu_purchase_order_low_conf.yml b/signals/content/nlu_purchase_order_low_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Tag: Purchase Order - Low Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "purchase_order" and .confidence == "low")
+tags:
+  - "Natural Language Understanding"
+  - "Purchase Order"
diff --git a/signals/content/nlu_purchase_order_medium_conf.yml b/signals/content/nlu_purchase_order_medium_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Tag: Purchase Order - Medium Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "purchase_order" and .confidence == "medium")
+tags:
+  - "Natural Language Understanding"
+  - "Purchase Order"
diff --git a/signals/content/nlu_recipient_entity.yml b/signals/content/nlu_recipient_entity.yml
@@ -0,0 +1,7 @@
+name: "NLU Entity: Recipient"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "recipient")
+tags:
+  - "Natural Language Understanding"
+
diff --git a/signals/content/nlu_request_entity.yml b/signals/content/nlu_request_entity.yml
@@ -0,0 +1,7 @@
+name: "NLU Entity: Request"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "request")
+tags:
+  - "Natural Language Understanding"
+
diff --git a/signals/content/nlu_salutation_entity.yml b/signals/content/nlu_salutation_entity.yml
@@ -0,0 +1,7 @@
+name: "NLU Entity: Salutation"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "salutation")
+tags:
+  - "Natural Language Understanding"
+
diff --git a/signals/content/nlu_sender_entity.yml b/signals/content/nlu_sender_entity.yml
@@ -0,0 +1,7 @@
+name: "NLU Entity: Sender"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "sender")
+tags:
+  - "Natural Language Understanding"
+
diff --git a/signals/content/nlu_steal_pii_high_conf.yml b/signals/content/nlu_steal_pii_high_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Steal PII - High Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "steal_pii" and .confidence == "high")
+tags:
+  - "Natural Language Understanding"
+  - "Steal PII"
diff --git a/signals/content/nlu_steal_pii_low_conf.yml b/signals/content/nlu_steal_pii_low_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Steal PII - Low Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "steal_pii" and .confidence == "low")
+tags:
+  - "Natural Language Understanding"
+  - "Steal PII"
diff --git a/signals/content/nlu_steal_pii_medium_conf.yml b/signals/content/nlu_steal_pii_medium_conf.yml
@@ -0,0 +1,7 @@
+name: "NLU Intent: Steal PII - Medium Confidence"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "steal_pii" and .confidence == "medium")
+tags:
+  - "Natural Language Understanding"
+  - "Steal PII"
diff --git a/signals/content/nlu_urgency_entity.yml b/signals/content/nlu_urgency_entity.yml
@@ -0,0 +1,7 @@
+name: "NLU Entity: Urgency"
+type: "query"
+source: |
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency")
+tags:
+  - "Natural Language Understanding"
+