automation-IsEmailAddressInternal_copy.yml

commonfields:
  id: 163eee05-b28c-4088-887d-33e14c1468fb
  version: 8
name: IsEmailAddressInternal_copy
script: |-
  import re
  from distutils.util import strtobool

  email = demisto.args()['email']
  domains = [x.lower() for x in argToList(demisto.get(demisto.args(),'domain'))]
  include_subdomain = strtobool(demisto.getArg('includeSubdomain'))

  parts = email.split('@',1)

  network_type = "Unknown"
  in_domain = "no"

  if len(parts) > 1:
      if parts[1].lower() in domains or include_subdomain and re.match("^(.*\.)?({})".format('|'.join([re.escape(d) for d in domains])), parts[1].lower()):
          in_domain = "yes"
          network_type = "Internal"
      else:
          network_type = "External"

      email_dict = {
          "Address" : email,
          "Domain" : parts[1],
          "Username": parts[0],
          "NetworkType" : network_type
      }

      email_obj = {
          "Account.Email(val.Address && val.Address == obj.Address)": email_dict
      }
      demisto.results({
          "Type" : entryTypes["note"],
          "ContentsFormat" : formats["json"],
          "Contents" : in_domain,
          "HumanReadable" : in_domain,
          "EntryContext" : email_obj
      })

  else:
      demisto.results({ "Type" : entryTypes["error"], "ContentsFormat" : formats["text"], "Contents" : 'Email address "{0}" is not valid' })
      sys.exit(0)
type: python
tags:
- email
comment: Checks if the email address in part of the internal domains
enabled: true
args:
- name: email
  required: true
  default: true
  description: The email address to check
- name: domain
  description: List of internal domains to check, comma separated
- name: includeSubdomain
  auto: PREDEFINED
  predefined:
  - "yes"
  - "no"
  description: Include subdomains of the domain list?
  defaultValue: "no"
outputs:
- contextPath: Account.Email.Address
  description: The Email account full address
  type: string
- contextPath: Account.Email.Username
  description: The Email account username
  type: string
- contextPath: Account.Email.Domain
  description: The Email account domain
  type: string
- contextPath: Account.Email.NetworkType
  description: The Email account NetworkType (could be Internal/External)
  type: string
scripttarget: 0
runonce: false
runas: DBotWeakRole