import demistomock as demisto # noqa: F401
from CommonServerPython import * # noqa: F401
def levenshtein(s1, s2):
l1 = len(s1)
l2 = len(s2)
matrix = [list(range(l1 + 1))] * (l2 + 1)
for zz in range(l2 + 1):
matrix[zz] = list(range(zz, zz + l1 + 1))
for zz in range(l2):
for sz in range(l1):
if s1[sz] == s2[zz]:
matrix[zz + 1][sz + 1] = min(matrix[zz + 1][sz] + 1, matrix[zz][sz + 1] + 1, matrix[zz][sz])
else:
matrix[zz + 1][sz + 1] = min(matrix[zz + 1][sz] + 1, matrix[zz][sz + 1] + 1, matrix[zz][sz] + 1)
return matrix[l2][l1]
def main():
res = []
found = False
domains = argToList(demisto.get(demisto.args(), "domain"))
if not domains:
res.append(
{
"Type": entryTypes["error"],
"ContentsFormat": formats["text"],
"Contents": "Unable to extract domain from arguments",
}
)
else:
sender = demisto.get(demisto.args(), "sender")
if sender:
parts = sender.split("@")
if len(parts) == 2:
if parts[1] not in domains:
distances = []
for domain in domains:
distance = levenshtein(domain, parts[1])
distances.append(distance)
closeDistance = demisto.get(demisto.args(), "distance")
closeDistanceInt = int(closeDistance) if closeDistance else 3
if distance > 0 and distance < closeDistanceInt:
res.append(
{
"Type": entryTypes["note"],
"ContentsFormat": formats["text"],
"Contents": "Domain " + parts[1] + " is suspiciously close to " + domain,
}
)
found = True
if len(distances) > 0:
# Override the context on each run
demisto.setContext("LevenshteinDistance", distances if len(distances) > 1 else distances[0])
else:
res.append(
{
"Type": entryTypes["error"],
"ContentsFormat": formats["text"],
"Contents": "Unable to extract domain from sender - " + sender,
}
)
else:
res.append(
{"Type": entryTypes["error"], "ContentsFormat": formats["text"], "Contents": "Unable to find sender in email"}
)
if found:
res.append("yes") # type: ignore
else:
res.append("no") # type: ignore
demisto.results(res)
if __name__ in ("__main__", "__builtin__", "builtins"):
main()