args:
- description: Additional text by which to query incidents.
  name: query
- description: The field name with the label. Supports a comma-separated list, the first non-empty value will be taken.
  name: tagField
  required: true
- defaultValue: '*'
  description: 'A comma-separated list of email tag values and mapping. The script considers only the tags specified in this field. You can map a label to another value by using this format: LABEL:MAPPED_LABEL. For example, for 4 values in an email tag: malicious, credentials harvesting, inner communication, external legit email, unclassified. While training, we want to ignore the "unclassified" tag, and refer to "credentials harvesting" as "malicious" too. Also, we want to merge "inner communication" and "external legit email" to one tag called "non-malicious". The input will be: malicious, credentials harvesting:malicious, inner communication:non-malicious, external legit email:non-malicious.'
  name: phishingLabels
comment: 'A helper script for the DBot Create Phishing Classifier V2 playbook. This script extends the query based on the phishingLabels argument.'
commonfields:
  id: ExtendQueryBasedOnPhishingLabels
  version: -1
enabled: true
name: ExtendQueryBasedOnPhishingLabels
outputs:
- contextPath: ExtendQueryBasedOnPhishingLabels.extendedQuery
  type: Unknown
  description: The original query extended by a part which takes into account the phishingLabels argument.
script: '-'
subtype: python3
tags:
- ml
timeout: '0'
type: python
dockerimage: demisto/python3:3.12.8.3296088
runas: DBotWeakRole
fromversion: 5.0.0
tests:
- Create Phishing Classifier V2 ML Test