SplitCampaignContext

Splits incidents in the context data to below and above a similarity threshold. If a low similarity incident was already added to the campaign, then it will also be considered in the higher similarity incidents list. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Phishing Campaign

Details

IDSplitCampaignContext
Languagepython
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658

README

Permissions

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name Description
Script Type python3
Tags  
Cortex XSOAR Version 5.5.0

Inputs

Argument Name Description
SimilarityThresholdToSplitBy The similarity value on which to split the context campaign data.
campaign_context_path The context full path of the EmailCampaign.

Outputs

Path Description Type
EmailCampaign.incidents.id The IDs of the incidents involved in the campaign. Unknown
EmailCampaign.incidents.similarity The textual similarity of the related emails to the current incident. Unknown
EmailCampaign.incidents.emailfrom The senders of the emails involved in the campaign. Unknown
EmailCampaign.incidents.emailfromdomain The domains of the email senders involved in the campaign. Unknown
EmailCampaign.incidents.recipients A list of email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”. Unknown
EmailCampaign.incidents.recipientsdomain A list of the domains of the email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”. Unknown
EmailCampaign.LowerSimilarityIncidents.id The IDs of the incidents involved in the campaign. Unknown
EmailCampaign.LowerSimilarityIncidents.similarity The textual similarity of the related emails to the current incident. Unknown
EmailCampaign.LowerSimilarityIncidents.emailfrom The senders of the emails involved in the campaign. Unknown
EmailCampaign.LowerSimilarityIncidents.emailfromdomain The domains of the email senders involved in the campaign. Unknown
EmailCampaign.LowerSimilarityIncidents.recipients A list of email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”. Unknown
EmailCampaign.LowerSimilarityIncidents.recipientsdomain A list of the domains of the email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”. Unknown

Source

SplitCampaignContext.py SplitCampaignContext_test.py SplitCampaignContext.yml
Download History Raw 
import pytest
import SplitCampaignContext

CONTEXT_EXAMPLE = [
    {
        "emailfrom": "example@example.com",
        "emailfromdomain": "example.com",
        "id": "1",
        "name": "example1",
        "occurred": "2021-07-15T11:24:46.869394623Z",
        "recipients": ["victim-test2@demistodev.onmicrosoft.com"],
        "recipientsdomain": ["example.com"],
        "severity": 3,
        "similarity": 1,
        "status": 1,
    },
    {
        "emailfrom": "example@example.com",
        "emailfromdomain": "example.com",
        "id": "2",
        "name": "example2",
        "occurred": "2021-07-13T08:42:32.344058566Z",
        "recipients": ["victim-test2@demistodev.onmicrosoft.com"],
        "recipientsdomain": ["example.com"],
        "severity": 3,
        "similarity": 0.9,
        "status": 1,
    },
    {
        "emailfrom": "example@example.com",
        "emailfromdomain": "example.com",
        "id": "398",
        "name": "example3",
        "occurred": "2021-07-13T08:47:28.067532466Z",
        "recipients": ["victim-test2@demistodev.onmicrosoft.com"],
        "recipientsdomain": ["example.com"],
        "severity": 3,
        "similarity": 0.85,
        "status": 1,
    },
    {
        "emailfrom": "example@example.com",
        "emailfromdomain": "example.com",
        "id": "4",
        "name": "example4",
        "occurred": "2021-07-13T11:20:43.144384137Z",
        "recipients": ["victim-test2@demistodev.onmicrosoft.com"],
        "recipientsdomain": ["example.com"],
        "severity": 1,
        "similarity": 0.82,
        "status": 1,
    },
]

CONTEXT_EXAMPLE_EMPTY = []
CASES = [
    (
        CONTEXT_EXAMPLE,
        0.84,
        [
            {
                "emailfrom": "example@example.com",
                "emailfromdomain": "example.com",
                "id": "4",
                "name": "example4",
                "occurred": "2021-07-13T11:20:43.144384137Z",
                "recipients": ["victim-test2@demistodev.onmicrosoft.com"],
                "recipientsdomain": ["example.com"],
                "severity": 1,
                "similarity": 0.82,
                "status": 1,
            }
        ],
        [
            {
                "emailfrom": "example@example.com",
                "emailfromdomain": "example.com",
                "id": "1",
                "name": "example1",
                "occurred": "2021-07-15T11:24:46.869394623Z",
                "recipients": ["victim-test2@demistodev.onmicrosoft.com"],
                "recipientsdomain": ["example.com"],
                "severity": 3,
                "similarity": 1,
                "status": 1,
            },
            {
                "emailfrom": "example@example.com",
                "emailfromdomain": "example.com",
                "id": "2",
                "name": "example2",
                "occurred": "2021-07-13T08:42:32.344058566Z",
                "recipients": ["victim-test2@demistodev.onmicrosoft.com"],
                "recipientsdomain": ["example.com"],
                "severity": 3,
                "similarity": 0.9,
                "status": 1,
            },
            {
                "emailfrom": "example@example.com",
                "emailfromdomain": "example.com",
                "id": "398",
                "name": "example3",
                "occurred": "2021-07-13T08:47:28.067532466Z",
                "recipients": ["victim-test2@demistodev.onmicrosoft.com"],
                "recipientsdomain": ["example.com"],
                "severity": 3,
                "similarity": 0.85,
                "status": 1,
            },
        ],
        False,
    ),
    (
        CONTEXT_EXAMPLE,
        0.84,
        [],
        [
            {
                "emailfrom": "example@example.com",
                "emailfromdomain": "example.com",
                "id": "4",
                "name": "example4",
                "occurred": "2021-07-13T11:20:43.144384137Z",
                "recipients": ["victim-test2@demistodev.onmicrosoft.com"],
                "recipientsdomain": ["example.com"],
                "severity": 1,
                "similarity": 0.82,
                "status": 1,
            },
            {
                "emailfrom": "example@example.com",
                "emailfromdomain": "example.com",
                "id": "4",
                "name": "example4",
                "occurred": "2021-07-13T11:20:43.144384137Z",
                "recipients": ["victim-test2@demistodev.onmicrosoft.com"],
                "recipientsdomain": ["example.com"],
                "severity": 1,
                "similarity": 0.85,
                "status": 1,
            },
        ],
        True,
    ),
    (CONTEXT_EXAMPLE_EMPTY, 0.84, [], [], False),
]


@pytest.mark.parametrize("context, threshold, expected_low, expected_high, part_of_campaign", CASES)
def test_filter_by_threshold(mocker, context, threshold, expected_low, expected_high, part_of_campaign):
    """
    Given:
        Context with incidents with different similarities and a threshold for low similarity
    When:
        Splitting context to low/ high similarity incidents
    Then:
        Makes sure the incidents with low similarities goes to 'low' similarity and the rest to 'high'
    """
    mocker.patch.object(SplitCampaignContext, "_get_incident_campaign", return_value=part_of_campaign)
    low, high = SplitCampaignContext.filter_by_threshold(context, threshold)
    assert low == expected_low, high == expected_high


CAMPAIGN_CASES = [(CONTEXT_EXAMPLE, 0.84)]


@pytest.mark.parametrize("context, threshold", CAMPAIGN_CASES)
def test_filter_by_threshold_with_campaign(mocker, context, threshold):
    """
    Given:
        Context with incidents with campaign id and a threshold for low similarity
    When:
        Splitting context to low/ high similarity incidents
    Then:
        Makes sure the incidents with campaign goes to 'high' similarity.
    """
    mocker.patch.object(SplitCampaignContext, "_get_incident_campaign", return_value=2)
    low, high = SplitCampaignContext.filter_by_threshold(context[-1:], threshold)
    assert low == [], high == [
        {
            "emailfrom": "example@example.com",
            "emailfromdomain": "example.com",
            "id": "4",
            "name": "example4",
            "occurred": "2021-07-13T11:20:43.144384137Z",
            "recipients": ["victim-test2@demistodev.onmicrosoft.com"],
            "recipientsdomain": ["example.com"],
            "severity": 1,
            "similarity": 0.82,
            "status": 1,
        }
    ]