docs: Cross-language threat detection capabilities

concepts/detections.mdx

@@ -9,6 +9,8 @@ A **detection** is a potential security threat that has been automatically ident
 
 Detections represent automated findings from ChainPatrol's continuous monitoring across the internet.
 
+ChainPatrol detects threats across multiple languages. The system uses LLM-based cross-language recognition to classify non-English threats. Some detection rules are English-specific, so non-English threats identified through LLM recognition may not always reach the confidence threshold for automatic blocking — but they will be correctly classified for auto-reporting at minimum. Auto-reported non-English threats enter the review queue where human reviewers can make the final call on whether to block or allow the asset.
+
 ### Components of a Detection
 
 Each detection contains:
@@ -94,4 +96,4 @@ The system automatically handles duplicate detections to prevent alert fatigue:
 - Detection is the entry point, not the decision: A detection indicates potential threat, but review and approval are required before blocking to prevent false positives
 - Group IDs reveal campaign scope: When one detection links to multiple related assets, you can identify and report entire phishing campaigns instead of blocking sites one at a time
 - Threshold configuration balances coverage and noise: Lower thresholds catch more threats but require more review, while higher thresholds miss edge cases but reduce workload
-- Deduplication across sources increases confidence: When multiple independent detection sources flag the same asset, it provides stronger evidence of malicious intent
+- Deduplication across sources increases confidence: When multiple independent detection sources flag the same asset, it provides stronger evidence of malicious intent

getting-started/how-it-works/detection-sources.mdx

@@ -7,6 +7,8 @@ description: "Automated monitoring systems that continuously scan the internet f
 
 Detection sources are automated monitoring systems that continuously scan the internet for potential threats to your brand. Each source monitors a specific platform or data stream, searching for suspicious assets that may be impersonating your organization or attempting to defraud your users.
 
+<Note>ChainPatrol's detection system supports cross-language threat recognition. Using LLM-based analysis, the system can classify threats in non-English languages. While some detection rules primarily consider English words, non-English threats are still identified and auto-reported for human review, ensuring global coverage for your brand protection.</Note>
+
 ## How Detection Sources Work
 
 Detection sources operate on automated schedules, running searches across various platforms using your organization's **included terms** (brand names, products, keywords you want to monitor) and **excluded terms** (legitimate domains you want to filter out). When a source finds a potential threat, it automatically submits the asset for analysis through ChainPatrol's threat detection pipeline.