Classifier

The Classifier uses NLP and machine learning to evaluate a wide range of input signals in real time and returns a numeric score for how likely that input is legitimate vs. unwanted, so you can accept, flag, or block based on your own threshold.

What it evaluates

• Text content — multi-layered NLP scoring (spam/abuse patterns, injection attempts, and more — see rules below).
• Email addresses — disposable-domain detection, DMARC/MX checks, free-provider identification.
• IP addresses — hosting/datacenter detection, known-malicious blocklists, proxy/Tor detection.
• Device/headers — bot detection, missing standard headers.
• Location — high-risk country matching, "fast traveler" detection (comparing current location against a recent known one).
• Can also integrate rate limiting and Similarity & Training Data matching in the same request.

Performance is around 10ms for a 10KB text payload.

Classification bands

Using the API

POST /v1/classifier
Authorization: Bearer {API_KEY}

Requires an API key on a Security Group with Restricted access — see API Keys.

You can classify one or several of these in a single request:

Text

{ "text": "Example text to classify" }

Form fields

{
  "fields": {
    "email": "text@example.com",
    "name": "John Doe",
    "message": "Hello, I need help with checkout on your website."
  }
}

Email (domain only is enough, and better for privacy)

{ "email": "gmail.com" }

IP address

{ "ip": "127.0.0.1" }

Device (from request headers)

{
  "headers": {
    "Accept": "...",
    "Accept-Language": "...",
    "User-Agent": "..."
  }
}

Location, with fast-traveler detection

{
  "ip": "127.0.0.1",
  "timeZone": "Europe/London",
  "lastKnownLocation": { "latitude": 51.5074, "longitude": -0.1278 }
}

Rate limiting, in the same call

{
  "rateLimit": { "customKey": "{USER_ID}", "limit": "10/1h", "memory": true }
}

Similarity matching, in the same call

{
  "similarity": [{ "groups": ["chat_spam"], "partial": true, "stopOnMatch": 0.7 }],
  "text": "Example text to classify"
}

Enabling/disabling specific rules per request

{
  "text": "Example",
  "disableRules": ["CAPITALIZATION"],
  "enableRules": ["PROFANITY"]
}

Response

{
  "classification": "NEUTRAL",
  "score": 1,
  "triggeredRules": ["SHORT_TEXT"],
  "text": {
    "classifier": "en",
    "language": "en",
    "score": 1,
    "time": 11.93,
    "rules": { "CAPITALIZATION": { "score": 0 }, "PROFANITY": { "score": 0 } },
    "triggeredRules": ["SHORT_TEXT"]
  },
  "email": null,
  "ip": null,
  "location": null,
  "device": null,
  "similarity": null,
  "rateLimit": null,
  "timeZone": null
}

score above 2 typically indicates spam; triggeredRules lists which rules fired, sorted by contribution to the score.

Text classification rules

Email, IP, location, and device rules

Toggle individual rules per Security Group with the enableClassificationRules / disableClassificationRules rule fields, or per-request with enableRules/disableRules as shown above.

Setup

1. Finish installing Sentinel.
2. Configure an IP Resolver — IP classification depends on it.
3. Create an API Key on a Security Group with Restricted access.

Language support

The Classifier's dedicated NLP rules are fully supported in 19 languages (including English, French, German, Spanish, Italian, and Portuguese); other languages fall back to English-based heuristics. This is separate from Sentinel's general language detection, which recognizes 160+ languages regardless of classifier support.

Best practices

• Submit multiple data points (text, email, IP, device) in a single request rather than separately — it reduces false positives, since the Classifier can cross-reference them.
• For privacy, send only the email domain (gmail.com) rather than the full address where you don't need the full address.
• Keep lastKnownLocation recent (within hours) for fast-traveler detection to be meaningful.
• Tune enableRules/disableRules per use case rather than accepting the full default set everywhere.

Related

• Forms — attaching the Classifier to submitted fields.
• Security Groups — the classifyFields, enableClassificationRules, disableClassificationRules rule fields.
• Phishing Detection — the URL_PHISHING rule this integrates with.
• Similarity & Training Data
• Chat & Forum Moderation — a usage example.