> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/phishing-classifier-demo.md). # Phishing Classifier Demo You can use a pretrained phishing classifier which enables you to get a prediction for a phishing incident using Cortex XSOAR’s pre-trained model. The main purpose of the classifier is to demonstrate how the phishing classifier feature works, using the **`DBotPredictOutOfTheBoxV2`** automation, so that you learn how to train a classifier using your own data. After running the feature, you can see how it works in practice and then create your own machine learning models. {% hint style="info" %} ### Note * It is not recommend using the classifier for production. It is intended for demonstration purposes only. * When using the out-of the-box phishing playbooks, such as **Phishing - Generic v3**, the playbook uses the **`DbotPredictPhishingWords`** automation and not the **`DBotPredictOutOfTheBoxV2`** automation used in this phishing classifier demo. {% endhint %} To run the phishing classifier demo, do the following: 1. Install the [Machine Learning](https://xsoar.pan.dev/marketplace/details/ML) content pack from the Marketplace. 2. Type the **`!DBotPredictOutOfTheBoxV2`** command, and add the relevant [parameters](#UUID-66be53cd-c038-85ae-f7d2-a586bd21e459). For example, **``!DBotPredictOutOfTheBoxV2 emailBody=``.``**

Note

The output parameters are the same as the output of DBotPredictPhishingWord. The DBotPredictPhishingWord automation allows you to get a prediction for a phishing incident, using a model trained using your own classifier. For more information, see Machine Learning Models.

You can see that the **demisto\_out\_of\_the\_box\_model\_v2** machine learning model has been created, by going to Settings → ADVANCED → **ML Models**. For practical examples, see [Phishing Classifier Demo Examples](#UUID-7448e254-a247-781f-3341-d9f6e184c844). ### **Phishing Classifier Demo Parameters** The following table describes the phishing classifier demo parameters when using the **`DbotPredictOutOfTheBoxV2`** automation. | Parameter | Description | | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **`emailSubject`** | The plain text of the email subject for which you want to the prediction. | | **`emailBody`** | The plain text of the email body for which you want to get the prediction. | | **`emailBodyHTML`** | The HTML of the email for which you want to get the prediction. If the email body is filled, this field can be left empty. | | **`topWordsLimit`** | Maximum number of words to highlight in the result. | | **`wordThreshold`** | The lower this value is, the more words will be highlighted in the results. | | **`minTextLength`** | Minimum length of text (subject and body) required for getting a prediction. | | **`confidenceThreshold`** | All predictions are given in a confidence value between 0-1. If this parameter is set to 0, all model predictions are given. If more than 0, only confidence predictions higher than this value are given. | | **`returnError`** | Whether to return an error where there is no prediction. | | **`setIncidentFields`** | Whether to set out-of-the-box DBot incident fields. | ### **Phishing Classifier Demo Output Parameters** After running the **`DbotPredictOutOfTheBoxV2`** command, the following output parameters may be generated. | Parameter | Description | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **`TextTokensHighlighted`** | The text of the email message with the highlighted positive words (if found). | | **`Label`** | The predicted label of the message. | | **`Confidence`** | The confidence of the label (between 0-1). The higher this value, the more confident the classifier is in its prediction. | | **`PositiveWords`** | The words that encouraged the model to make the prediction. | | **`NegativeWords`** | The words that are in general not correlated with the prediction class and reduced the model’s confidence in its prediction. For example, **`!DBotPredictOutOfTheBoxV2 emailBody="this is a test email. do not delete. Click http://phishing-emails.com"`**, returned a Non-malicious label, confidence 0.54 and the negative words were **`a, email.`** | ### **Phishing Classifier Demo Examples** The following examples describe the Phishing Classifer Demo parameters and output, when running the **`DbotPredictOutOfTheBoxV2`** automation. Run the following command in the Playground: **`!DBotPredictOutOfTheBox emailBody=`*****`""`*****`.`** | Label | Message | | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Malicious | Your email account was LOGIN today by Unknown IP address: 10.240.180.228, click on UPDATE <[http://helpd.moonfruit.com/>](http://helpd.moonfruit.com/>) to validate and verify your email account now to avoid Outlook Web App been disabled for user | | | ![dbot-phishing1.png](/files/YmLqz0SmBWFDvcxwzkXz) | | Non-Malicious | To stop receiving these emails, just hit ‘Reply’ and let us know. Thanks | | | ![dbot-phishing.png](/files/Ps1W2G8V2tBzDCKMI64f) | | Malicious | Your email password expires in 2 days to retain email password and details. CLICK HERE to update immediately | | | ![dbot-phishing3.png](/files/n6oqMnN9330XzTMKGWo2) | | Non-Malicious | Your PayPal account has been suspended due to suspicious activity. Please contact us immediately at 1-409-123-457 ex.112 or visit | | | ![dbot-phishing4.png](/files/NX3TE9vtLBhYEAG8oc6L) | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/phishing-classifier-demo.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.