Hello Yohji and Dídac,

Dídac email.header is what you're looking for to trigger all Email Sender Name Artifacts (Name of suspicious email sender) or Email Subject Artifacts (Suspicious email subject). email.header.sender_address will trigger all Email Sender Address Artifacts (Suspicious email sender). If it's an email address that you're trying to scan you'll need to use Email Sender Address Artifact and use email.header.sender_address for the handler.

Yohji I just skimmed the CTS guide and I think the typo you're referring to is in Chapter 6 Data Structures under ArtifactPropertyDTO? You're right it should be lat_lng property type, thank you for informing us of the typo. We'll make a correction and update the guide.

Please let us know if you have any more questions.

Cheers,
Tamara Zlender

It seemed to me that there are some differences between the artifact list in Resilient web page and the list related to Email artifacts in CTS guide

Hello Yohji and Dídac,

Dídac email.header is what you're looking for to trigger all Email Sender Name Artifacts (Name of suspicious email sender) or Email Subject Artifacts (Suspicious email subject). email.header.sender_address will trigger all Email Sender Address Artifacts (Suspicious email sender). If it's an email address that you're trying to scan you'll need to use Email Sender Address Artifact and use email.header.sender_address for the handler.

Yohji I just skimmed the CTS guide and I think the typo you're referring to is in Chapter 6 Data Structures under ArtifactPropertyDTO? You're right it should be lat_lng property type, thank you for informing us of the typo. We'll make a correction and update the guide.

Please let us know if you have any more questions.

Cheers,
Tamara Zlender

It seemed to me that there are some differences between the artifact list in Resilient web page and the list related to Email artifacts in CTS guide

Hello Yohji and Dídac,

Dídac email.header is what you're looking for to trigger all Email Sender Name Artifacts (Name of suspicious email sender) or Email Subject Artifacts (Suspicious email subject). email.header.sender_address will trigger all Email Sender Address Artifacts (Suspicious email sender). If it's an email address that you're trying to scan you'll need to use Email Sender Address Artifact and use email.header.sender_address for the handler.

Yohji I just skimmed the CTS guide and I think the typo you're referring to is in Chapter 6 Data Structures under ArtifactPropertyDTO? You're right it should be lat_lng property type, thank you for informing us of the typo. We'll make a correction and update the guide.

Please let us know if you have any more questions.

Cheers,
Tamara Zlender

Hello Yohji and Dídac,

I was able to confirm 'Email Sender Address' is not a valid Artifact Type, email.header.sender_address isn't available to use. This is bug in our documentation. We will update the documentation with our next release. I apologize for the confusion.

You could use 'Email Sender' and email.header to scan an email address with a CTS. Having said that I understand CTS is being executed for both 'Email Sender' and 'Email Subject' Artifacts Types and that in your use case this isn't a desired outcome.
At the moment I don't think there is a good way to filter them in Python code, CTS only knows about artifact's value and type. You could theoretically check the value if it includes an '@' character but this might not be a solution you were hoping for.
Also this sounds like a good idea to post at Resilient Ideas (RFEs) https://success.resilientsystems.com/hc/en-us/articles/360000627425-Ideas-formerly-RFEs

Best,
Tamara Zlender

It seemed to me that there are some differences between the artifact list in Resilient web page and the list related to Email artifacts in CTS guide

Hello Yohji and Dídac,

Dídac email.header is what you're looking for to trigger all Email Sender Name Artifacts (Name of suspicious email sender) or Email Subject Artifacts (Suspicious email subject). email.header.sender_address will trigger all Email Sender Address Artifacts (Suspicious email sender). If it's an email address that you're trying to scan you'll need to use Email Sender Address Artifact and use email.header.sender_address for the handler.

Yohji I just skimmed the CTS guide and I think the typo you're referring to is in Chapter 6 Data Structures under ArtifactPropertyDTO? You're right it should be lat_lng property type, thank you for informing us of the typo. We'll make a correction and update the guide.

Please let us know if you have any more questions.

Cheers,
Tamara Zlender