Brand Impersonation: Navan

type.inbound
and (
  regex.icontains(sender.display_name, '(?:The\s+)?\bNavan\b(?:\s+Team)?')
  or strings.ilike(sender.email.domain.domain, '*Navan*')
)
and (
  any(ml.logo_detect(beta.message_screenshot()).brands,
      .name == "Navan" and .confidence in ("medium", "high")
  )
  or (
    regex.icontains(subject.subject,
                    "(?:unrecognized|Unusual|suspicious|unknown) (?:log|sign).?[io]n attempt",
                    "(?:important|urgent|attention|alert) account|accessed|[new|unrecognized|suspicious] location"
    )
    or any(ml.nlu_classifier(body.current_thread.text).entities,
           .name == "urgency"
    )
    or any(ml.nlu_classifier(body.current_thread.text).intents,
           .name in ("cred_theft", "steal_pii")
    )
  )
)
and sender.email.domain.root_domain not in~ ('navan.com')

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_false_positives
  )
)
and not profile.by_sender().any_false_positives