Phishing Classifier Demo

Use the phishing classifier demo in Cortex XSOAR 6.13.

You can use a pretrained phishing classifier which enables you to get a prediction for a phishing incident using Cortex XSOAR’s pre-trained model.

The main purpose of the classifier is to demonstrate how the phishing classifier feature works, using the DBotPredictOutOfTheBoxV2 automation, so that you learn how to train a classifier using your own data.

After running the feature, you can see how it works in practice and then create your own machine learning models.

Note

• It is not recommend using the classifier for production. It is intended for demonstration purposes only.
• When using the out-of the-box phishing playbooks, such as Phishing - Generic v3, the playbook uses the DbotPredictPhishingWords automation and not the DBotPredictOutOfTheBoxV2 automation used in this phishing classifier demo.

To run the phishing classifier demo, do the following:

1. Install the Machine Learning content pack from the Marketplace.
2. Type the !DBotPredictOutOfTheBoxV2 command, and add the relevant parameters. For example, !DBotPredictOutOfTheBoxV2 emailBody=`<Copy/paste some sample email body text here.>`.

   Note

   The output parameters are the same as the output of DBotPredictPhishingWord. The DBotPredictPhishingWord automation allows you to get a prediction for a phishing incident, using a model trained using your own classifier. For more information, see Machine Learning Models.

   You can see that the demisto_out_of_the_box_model_v2 machine learning model has been created, by going to Settings → ADVANCED → ML Models.

For practical examples, see Phishing Classifier Demo Examples.

Phishing Classifier Demo Parameters

The following table describes the phishing classifier demo parameters when using the DbotPredictOutOfTheBoxV2 automation.

Parameter	Description
emailSubject	The plain text of the email subject for which you want to the prediction.
emailBody	The plain text of the email body for which you want to get the prediction.
emailBodyHTML	The HTML of the email for which you want to get the prediction. If the email body is filled, this field can be left empty.
topWordsLimit	Maximum number of words to highlight in the result.
wordThreshold	The lower this value is, the more words will be highlighted in the results.
minTextLength	Minimum length of text (subject and body) required for getting a prediction.
confidenceThreshold	All predictions are given in a confidence value between 0-1. If this parameter is set to 0, all model predictions are given. If more than 0, only confidence predictions higher than this value are given.
returnError	Whether to return an error where there is no prediction.
setIncidentFields	Whether to set out-of-the-box DBot incident fields.

Phishing Classifier Demo Output Parameters

After running the DbotPredictOutOfTheBoxV2 command, the following output parameters may be generated.

Parameter	Description
TextTokensHighlighted	The text of the email message with the highlighted positive words (if found).
Label	The predicted label of the message.
Confidence	The confidence of the label (between 0-1). The higher this value, the more confident the classifier is in its prediction.
PositiveWords	The words that encouraged the model to make the prediction.
NegativeWords	The words that are in general not correlated with the prediction class and reduced the model’s confidence in its prediction. For example, !DBotPredictOutOfTheBoxV2 emailBody="this is a test email. do not delete. Click http://phishing-emails.com", returned a Non-malicious label, confidence 0.54 and the negative words were a, email.

Phishing Classifier Demo Examples

The following examples describe the Phishing Classifer Demo parameters and output, when running the DbotPredictOutOfTheBoxV2 automation.

Run the following command in the Playground:

!DBotPredictOutOfTheBox emailBody="<Message>".

Label	Message
Malicious	Your email account was LOGIN today by Unknown IP address: 10.240.180.228, click on UPDATE <http://helpd.moonfruit.com/> to validate and verify your email account now to avoid Outlook Web App been disabled for user
Non-Malicious	To stop receiving these emails, just hit ‘Reply’ and let us know. Thanks
Malicious	Your email password expires in 2 days to retain email password and details. CLICK HERE https://docs.google.com/forms/d/e/1FAIpQLSewQbYraWXtr4atKnGGyNncumJFKy-En54dvjVK6-Mxlu5G-A/viewform to update immediately
Non-Malicious	Your PayPal account has been suspended due to suspicious activity. Please contact us immediately at 1-409-123-457 ex.112 or visit https://paypal.mobile/111222.com/txn?id-112