From a9e1cfbd3642bef6b91c9b09be353970a83bd64d Mon Sep 17 00:00:00 2001 From: Nikita Varabei Date: Mon, 20 Jul 2026 09:05:49 -0400 Subject: [PATCH 1/2] docs: update Detections based on knowledge update "Cross-language threat detection capabilities" --- concepts/detections.mdx | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/concepts/detections.mdx b/concepts/detections.mdx index 04990bf..04eb41d 100644 --- a/concepts/detections.mdx +++ b/concepts/detections.mdx @@ -9,6 +9,8 @@ A **detection** is a potential security threat that has been automatically ident Detections represent automated findings from ChainPatrol's continuous monitoring across the internet. +ChainPatrol detects threats across multiple languages. The system uses LLM-based cross-language recognition to classify non-English threats. Some detection rules are English-specific, so non-English threats identified through LLM recognition may not always reach the confidence threshold for automatic blocking — but they will be correctly classified for auto-reporting at minimum. Auto-reported non-English threats enter the review queue where human reviewers can make the final call on whether to block or allow the asset. + ### Components of a Detection Each detection contains: @@ -94,4 +96,4 @@ The system automatically handles duplicate detections to prevent alert fatigue: - Detection is the entry point, not the decision: A detection indicates potential threat, but review and approval are required before blocking to prevent false positives - Group IDs reveal campaign scope: When one detection links to multiple related assets, you can identify and report entire phishing campaigns instead of blocking sites one at a time - Threshold configuration balances coverage and noise: Lower thresholds catch more threats but require more review, while higher thresholds miss edge cases but reduce workload -- Deduplication across sources increases confidence: When multiple independent detection sources flag the same asset, it provides stronger evidence of malicious intent +- Deduplication across sources increases confidence: When multiple independent detection sources flag the same asset, it provides stronger evidence of malicious intent \ No newline at end of file From 1f011b4be772a2bc9063578dd9bb43073241ac39 Mon Sep 17 00:00:00 2001 From: Nikita Varabei Date: Mon, 20 Jul 2026 09:06:13 -0400 Subject: [PATCH 2/2] docs: update Detection Sources based on knowledge update "Cross-language threat detection capabilities" --- getting-started/how-it-works/detection-sources.mdx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/getting-started/how-it-works/detection-sources.mdx b/getting-started/how-it-works/detection-sources.mdx index 48c3af7..680eb64 100644 --- a/getting-started/how-it-works/detection-sources.mdx +++ b/getting-started/how-it-works/detection-sources.mdx @@ -7,6 +7,8 @@ description: "Automated monitoring systems that continuously scan the internet f Detection sources are automated monitoring systems that continuously scan the internet for potential threats to your brand. Each source monitors a specific platform or data stream, searching for suspicious assets that may be impersonating your organization or attempting to defraud your users. +ChainPatrol's detection system supports cross-language threat recognition. Using LLM-based analysis, the system can classify threats in non-English languages. While some detection rules primarily consider English words, non-English threats are still identified and auto-reported for human review, ensuring global coverage for your brand protection. + ## How Detection Sources Work Detection sources operate on automated schedules, running searches across various platforms using your organization's **included terms** (brand names, products, keywords you want to monitor) and **excluded terms** (legitimate domains you want to filter out). When a source finds a potential threat, it automatically submits the asset for analysis through ChainPatrol's threat detection pipeline.