Train a Phishing Classifier on Non-English Languages

Train phishing classifiers for non-English languages in Cortex XSOAR 6.13.

Cortex XSOAR contains out-of-the-box automations and playbooks, which are used to train phishing classifiers. By default, classifiers are configured to support phishing incidents containing English emails only. You can train a phishing classifier using emails in other languages through tokenization methods.

Cortex XSOAR supports adjusted tokenization for the following languages:

• German
• French
• Spanish
• Portuguese
• Italian
• Dutch

Although you need to train the classifier, you do not need to configure tokenization. For more information on how to configure these languages see Train a Classifier on Languages with Adjusted Tokenization.

For all other languages, the language and tokenization method needs to be configured. For more information see Train a Classifier on Other Languages.

Train a Classifier on Languages with Adjusted Tokenization

Cortex XSOAR allows you to customize automations and playbooks to support phishing classifiers for languages other than English. Cortex XSOAR offers adjusted tokenization for the following languages:

• German
• French
• Spanish
• Portuguese
• Italian
• Dutch

You need to configure the following automations and playbooks:

• DBotPreProcessTextData
• WordTokenizerNLP
• DBotPredictPhishingWords
• DBot Create Phishing Classifier V2

1. Go to Automation.
2. Configure the language for DBotPreProcessTextData.

   1. Copy the DBotPreProcessTextData automation, by selecting Duplicate Automation.
   2. (Optional) Change the name of the duplicated automation to make it distinguishable.
   3. From the Advanced section, in the Docker image name field, type demisto/dl:languages1.0.
   4. In the Arguments section, expand the language argument.
   5. In the Initial value field, change the language to train the classifier.
   6. Click Save Version.
3. Configure the language for WordTokenizerNLP.

   1. Copy the WordTokenizerNLP automation, by selecting the Duplicate Automation.
   2. (Optional) Change the name of the duplicated automation to make it distinguishable.
   3. From the Advanced section, in the Docker image name field, type demisto/dl:languages1.0.
   4. In the Arguments section, expand the language argument.
   5. In the Initial value field, change the language to train the classifier.
   6. Click Save Version.
4. Configure the language for DBotPredictPhishingWords.

   1. Copy the DBotPredictPhishingWords automation by selecting Duplicate Automation.
   2. (Optional) Change the name of the duplicated automation to make it distinguishable.
   3. From the Advanced section, in the Docker image name field, type demisto/dl:languages1.0.
   4. In the Arguments section, expand the language argument.
   5. In the Initial value field change the language to train the classifier.
   6. Click Save Version.
5. Go to Playbooks.
6. Search for DBot Create Phishing Classifier V2 to update the playbook.

   1. Copy the playbook, by selecting Duplicate Playbook.
   2. Select the Pre-process file task.
   3. From the dropdown menu, replace the automation with the duplicated version of DBotPreProcessTextData created in Step 2.
   4. Click OK and Save Version.

Train a Classifier on Other Languages

To train a classifier on languages other than those referred to in Train a Classifier on Languages with Adjusted Tokenization, you need to configure the language and tokenization method. Tokenization is the method by which the classifier breaks up sentences and words to analyze threats appropriately. When the language for the classifier is configured to Other, the user can configure the method of tokenization by which to train a classifier on to one of the following options:

• Tokenization - (Default) automatically separate sentences by words
• Word - separates the text based on spacing
• Letter - separates the text based on charachters and symbols

Follow the steps below to adjust the language and tokenization method by which to train a classifier on for other languages.

1. Go to Automation.
2. Search for DBotPreProcessTextData.

   1. Copy the automation by selecting Duplicate Automation.
   2. (Optional) Change the name of the duplicated script to make it distinguishable.
   3. From the Argument section, expand the tokenizationMethod field, and change the Initial value to the desired tokenization method. For example, byWord.
   4. Expand the language field and change the Initial value to Other.
   5. Click Save.
3. Search for DBotPredictPhishingWords.

   1. Copy the automation, by selecting Duplicate Automation.
   2. (Optional) Change the name of the duplicated script to make it distinguishable.
   3. From the Argument section, expand the tokenizationMethod field, and change the Initial value to the desired tokenization method. For example, byWord.
   4. Expand the language field, and change the value to Other.
   5. Click Save.
4. Navigate to Playbooks.
5. Search for the DBot Create Phishing Classifier V2 playbook to update.

   1. Copy the playbook by selecting Duplicate Playbook.
   2. (Optional) Change the name of the duplicated playbook to make it distinguishable.
   3. Select the Pre-process file task.
   4. From the dropdown menu replace the automation with the duplicated version of DBotPreProcessTextData created in step 2.
   5. Click OK and Save Version.