Topic Detection

xorlab Security Platform (XSP) leverages Natural Language Understanding (NLU) to analyze email content and identify specific topics within the subject, body, and attachments. By recognizing key themes in messages, XSP enhances automated threat detection, helping to identify phishing attempts, fraud, and other malicious activities more effectively. The set of detectable topics will continue to expand over time as xorlab refines its models and introduces new capabilities. The following topics are currently detected by xorlab NLU:

​

Searching for topics

You can filter and search for emails based on detected topics using the topic attributes, as described in the Search Documentation.

​

How it Helps

xorlab NLU enhances automated detection and threat analysis by providing additional context for security decisions. By understanding the meaning and intent behind email content, XSP can:

• Increase detection accuracy: Helps distinguish between legitimate and suspicious emails by considering their topics in combination with other security signals.
• Improve prioritization: Automatically assigns higher risk scores to emails that match attack patterns, such as fraudulent invoices or fake account recovery requests.
• Reduce manual effort: Security teams don’t need to manually inspect emails for suspicious patterns—the platform detects and flags threats automatically.
• Enhance correlation with other indicators: Works alongside behavioral analysis and sender reputation checks to improve decision-making without analyst intervention.

​

Report misclassified topics

If you come across a misclassified topic, please report it — your feedback helps us continuously improve our product and its accuracy. To report a misclassified topic, follow these steps:

1. Enter the Message detail view of the email with the misclassified topic.
2. Click the three-dot menu at the top right, then Report Misclassification (also see Reporting Misclassification (False Positives/Negatives)).

3. Keep the following default settings:
   • Expected verdict as Other.
   • Severity level as Moderate.
   • Information shared as Share metadata, previews, and original email.
4. Add a comment mentioning that it’s a misclassified topic, and where the misclassified text is found. E.g. Misclassified topic: subject.
5. Click report.