FP/FN Negation: callback_phishing_nlu_body_or_attachments.yml (#750)

morriscode · web-flow · commit 0465b64954bd · 2023-09-08T18:19:27.000Z
diff --git a/detection-rules/callback_phishing_nlu_body_or_attachments.yml b/detection-rules/callback_phishing_nlu_body_or_attachments.yml
@@ -15,7 +15,9 @@ source: |
         )
     )
     or any(ml.nlu_classifier(body.current_thread.text).intents,
-           .name in ("callback_scam") and .confidence == "high"
+           .name in ("callback_scam")
+           and .confidence == "high"
+           and length(body.current_thread.text) < 1500
     )
   )
   and not (

Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,9 @@ source: \|`
`15`	`15`	`)`
`16`	`16`	`)`
`17`	`17`	`or any(ml.nlu_classifier(body.current_thread.text).intents,`
`18`		`- .name in ("callback_scam") and .confidence == "high"`
	`18`	`+ .name in ("callback_scam")`
	`19`	`+ and .confidence == "high"`
	`20`	`+ and length(body.current_thread.text) < 1500`
`19`	`21`	`)`
`20`	`22`	`)`
`21`	`23`	`and not (`