EmailDomainBlacklist

Accepts an array of domains as a block list, and a list of email addresses. The script then filters out any email address whose domain is in the block list. The filtered list will be returned as an array.

python · Filters And Transformers

Source

import demistomock as demisto


def csv_string_to_list(v):
    if type(v) is str:  # requires python3
        return v.lower().replace(" ", "").replace("\n", "").split(",")
    v = [val.lower() for val in v]
    return v


def main():
    DOMAIN_LIST = csv_string_to_list(demisto.args()["domain_list"])
    EMAIL_ADDRESSES = csv_string_to_list(demisto.args()["value"])

    filtered_addresses = []

    for address in EMAIL_ADDRESSES:
        [user, domain] = address.split("@")

        if domain not in DOMAIN_LIST:
            filtered_addresses.append(address)

    if len(filtered_addresses) != 0:
        demisto.results(filtered_addresses)
    else:
        demisto.results(None)


if __name__ == "__builtin__" or __name__ == "builtins":
    main()

README

Script Data

Name	Description
Script Type	python3
Tags	transformer, general, entirelist
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
value	An array of email addresses to be filtered by domain.
domain_list	An array of domains to block list.

Outputs

There are no outputs for this script.