Brand impersonation: Sedgwick Claims

type.inbound
and (
  strings.icontains(sender.display_name, "Sedgwick Claim")
  or (
    any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "sender" and .text == "Sedgwick"
    )
    and any(ml.nlu_classifier(body.current_thread.text).topics,
            .name == "Financial Communications" and .confidence == "high"
    )
    and any(body.links, strings.icontains(.display_text, "claim"))
  )
)
and not (
  sender.email.domain.root_domain in ("sedgwick.com", "sedgwickcms.com")
  and coalesce(headers.auth_summary.dmarc.pass, false)
)