args:
- defaultValue: type
  description: The name of the incident field in which the incident type is stored. Default is "type". Change this argument only if you are using a custom field for specifying the incident type.
  name: incidentTypeFieldName
- defaultValue: Phishing
  description: A comma-separated list of incident types by which to filter. Specify "None" to search through all incident types.
  name: incidentTypes
- defaultValue: 14 days ago
  description: 'The date from which to search for similar incidents. Date format is the same as in the incidents query page. For example: "3 days ago", "2019-01-01T00:00:00 +0200".'
  name: existingIncidentsLookback
- description: Additional text by which to query incidents.
  name: query
- defaultValue: '1000'
  description: The maximum number of incidents to fetch.
  name: limit
- auto: PREDEFINED
  defaultValue: emailsubject
  description: The name of the field that contains the email subject.
  name: emailSubject
  predefined:
  - Subject of the email.
- defaultValue: emailbody
  description: The name of the field that contains the email body.
  name: emailBody
- defaultValue: emailbodyhtml
  description: The name of the field that contains the HTML version of the email body.
  name: emailBodyHTML
- defaultValue: emailfrom
  description: The name of the field that contains the email sender.
  name: emailFrom
- auto: PREDEFINED
  defaultValue: All
  description: Whether to compare the new incident to closed incidents, unclosed incidents, or all incidents.
  name: statusScope
  predefined:
  - All
  - ClosedOnly
  - NonClosedOnly
- defaultValue: '0.8'
  description: Threshold by which to consider incidents as similar. The range of values is 0-1.
  name: threshold
- defaultValue: '30'
  description: The maximum number of incidents to display as part of a campaign. If a campaign includes a higher number of incidents, the results will contain only this amount of incidents.
  name: maxIncidentsToReturn
- defaultValue: '3'
  description: Minimum number of incidents to consider as a campaign.
  name: minIncidentsForCampaign
- defaultValue: '2'
  description: Minimum number of unique recipients of similar email incidents to consider as a campaign.
  name: minUniqueRecipients
- description: A comma-seperated list of fields to display. An example is "emailclassification,closereason". If a list of fields is provided, and a campaign is detected, these incidents fields will be displayed.
  name: fieldsToDisplay
  predefined:
  - ''
- defaultValue: 'false'
  description: Include the current incident in EmailCampaign path in context.
  name: includeSelf
  predefined:
  - 'true'
  - 'false'
- auto: PREDEFINED
  defaultValue: 'false'
  description: 'Whether to plot incidents-indicators relations to canvas. Default is "false". Skipping the canvas plotting stage would improve runtime. Note that canvas plotting would be skipped anyway if the number of incidents exceeds a certain threshold in order to avoid performance issues.'
  name: plotCanvas
  predefined:
  - 'true'
  - 'false'
comment: Find a campaign of emails based on their textual similarity.
commonfields:
  id: FindEmailCampaign
  version: -1
name: FindEmailCampaign
outputs:
- contextPath: EmailCampaign.isCampaignFound
  description: Whether a campaign was found.
  type: Boolean
- contextPath: EmailCampaign.involvedIncidentsCount
  description: The number of incidents involved in the campaign.
  type: Number
- contextPath: EmailCampaign.incidents.id
  description: The IDs of the incidents involved in the campaign.
  type: Unknown
- contextPath: EmailCampaign.incidents.similarity
  description: The textual similarity of the related emails to the current incident.
  type: Unknown
- contextPath: EmailCampaign.incidents.emailfrom
  description: The senders of the emails involved in the campaign.
  type: Unknown
- contextPath: EmailCampaign.incidents.emailfromdomain
  description: The domains of the email senders involved in the campaign.
  type: Unknown
- contextPath: EmailCampaign.incidents.recipients
  description: A list of email addresses of recipients involved in the campaign. The list is comprised of the following fields, "Email To", "Email CC", "Email BCC".
  type: Unknown
- contextPath: EmailCampaign.incidents.recipientsdomain
  description: A list of the domains of the email addresses of recipients involved in the campaign. The list is comprised of the following fields, "Email To", "Email CC", "Email BCC".
  type: Unknown
- contextPath: EmailCampaign.indicators.id
  description: The IDs of the mututal indicators of the incidents involved in the campaign.
  type: Unknown
- contextPath: EmailCampaign.indicators.value
  description: The values of the mututal indicators of the incidents involved in the campaign.
  type: Unknown
- contextPath: EmailCampaign.fieldsToDisplay
  description: List of fields to display in the linked list table.
  type: Unknown
- contextPath: EmailCampaign.firstIncidentDate
  description: The occurrence date of the oldest incident in the campaign.
  type: unknown
- contextPath: incident.emailcampaignsummary
  description: Markdown table with email campaign summary.
  type: string
- contextPath: incident.emailcampaignsnippets
  description: Markdown table with email content summary.
  type: string
- contextPath: incident.emailcampaignmutualindicators
  description: Markdown table with relevant indicators.
  type: string
- contextPath: incident.emailcampaigncanvas
  description: Link to the campaign canvas.
  type: string
script: '-'
subtype: python3
tags:
- ml
- phishing
timeout: '0'
type: python
dockerimage: demisto/sklearn:1.0.0.12545527
tests:
- Detect & Manage Phishing Campaigns - Test
fromversion: 5.0.0