SplitCampaignContext
Splits incidents in the context data to below and above a similarity threshold. If a low similarity incident was already added to the campaign, then it will also be considered in the higher similarity incidents list. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
python · Phishing Campaign
Details
| ID | SplitCampaignContext |
|---|---|
| Language | python |
| From Version | 5.5.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
README
Permissions
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | |
| Cortex XSOAR Version | 5.5.0 |
Inputs
| Argument Name | Description |
|---|---|
| SimilarityThresholdToSplitBy | The similarity value on which to split the context campaign data. |
| campaign_context_path | The context full path of the EmailCampaign. |
Outputs
| Path | Description | Type |
|---|---|---|
| EmailCampaign.incidents.id | The IDs of the incidents involved in the campaign. | Unknown |
| EmailCampaign.incidents.similarity | The textual similarity of the related emails to the current incident. | Unknown |
| EmailCampaign.incidents.emailfrom | The senders of the emails involved in the campaign. | Unknown |
| EmailCampaign.incidents.emailfromdomain | The domains of the email senders involved in the campaign. | Unknown |
| EmailCampaign.incidents.recipients | A list of email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”. | Unknown |
| EmailCampaign.incidents.recipientsdomain | A list of the domains of the email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”. | Unknown |
| EmailCampaign.LowerSimilarityIncidents.id | The IDs of the incidents involved in the campaign. | Unknown |
| EmailCampaign.LowerSimilarityIncidents.similarity | The textual similarity of the related emails to the current incident. | Unknown |
| EmailCampaign.LowerSimilarityIncidents.emailfrom | The senders of the emails involved in the campaign. | Unknown |
| EmailCampaign.LowerSimilarityIncidents.emailfromdomain | The domains of the email senders involved in the campaign. | Unknown |
| EmailCampaign.LowerSimilarityIncidents.recipients | A list of email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”. | Unknown |
| EmailCampaign.LowerSimilarityIncidents.recipientsdomain | A list of the domains of the email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”. | Unknown |
commonfields: id: SplitCampaignContext version: -1 name: SplitCampaignContext script: '' type: python comment: |- Splits incidents in the context data to below and above a similarity threshold. If a low similarity incident was already added to the campaign, then it will also be considered in the higher similarity incidents list. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script tags: [] enabled: true args: - name: similarity_threshold required: true defaultValue: "0.8" description: The similarity value on which to split the context campaign data. outputs: - contextPath: EmailCampaign.incidents.id description: The IDs of the incidents involved in the campaign. type: Number - contextPath: EmailCampaign.incidents.similarity description: The textual similarity of the related emails to the current incident. type: Number - contextPath: EmailCampaign.incidents.emailfrom description: The senders of the emails involved in the campaign. type: string - contextPath: EmailCampaign.incidents.emailfromdomain description: The domains of the email senders involved in the campaign. type: string - contextPath: EmailCampaign.incidents.recipients description: A list of email addresses of recipients involved in the campaign. The list is comprised of the following fields, "Email To", "Email CC", "Email BCC". type: string - contextPath: EmailCampaign.incidents.recipientsdomain description: A list of the domains of the email addresses of recipients involved in the campaign. The list is comprised of the following fields, "Email To", "Email CC", "Email BCC". type: Unknown - contextPath: EmailCampaign.LowerSimilarityIncidents.id description: The IDs of the incidents involved in the campaign. type: Number - contextPath: EmailCampaign.LowerSimilarityIncidents.similarity description: The textual similarity of the related emails to the current incident. type: Number - contextPath: EmailCampaign.LowerSimilarityIncidents.emailfrom description: The senders of the emails involved in the campaign. type: string - contextPath: EmailCampaign.LowerSimilarityIncidents.emailfromdomain description: The domains of the email senders involved in the campaign. type: string - contextPath: EmailCampaign.LowerSimilarityIncidents.recipients description: A list of email addresses of recipients involved in the campaign. The list is comprised of the following fields, "Email To", "Email CC", "Email BCC". type: string - contextPath: EmailCampaign.LowerSimilarityIncidents.recipientsdomain description: A list of the domains of the email addresses of recipients involved in the campaign. The list is comprised of the following fields, "Email To", "Email CC", "Email BCC". type: Unknown scripttarget: 0 subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 fromversion: 5.5.0 tests: - No tests (auto formatted)