From 1350b13468f4b1ac59db8ab8f414ea650d925f2c Mon Sep 17 00:00:00 2001
From: Sam Scholten <sam@sublimesecurity.com>
Date: Thu, 2 Nov 2023 17:54:14 -0400
Subject: [PATCH] New Insights (Sender Prevalence && Sender previously flagged
 malicious or spam) (#905)

---
 insights/sender/prevalence.yml                    | 5 +++++
 insights/sender/profile_any_malicious_or_spam.yml | 5 +++++
 2 files changed, 10 insertions(+)
 create mode 100644 insights/sender/prevalence.yml
 create mode 100644 insights/sender/profile_any_malicious_or_spam.yml

diff --git a/insights/sender/prevalence.yml b/insights/sender/prevalence.yml
new file mode 100644
index 00000000000..fb00d118fe4
--- /dev/null
+++ b/insights/sender/prevalence.yml
@@ -0,0 +1,5 @@
+name: "Sender Prevalence"
+type: "query"
+source: |
+  profile.by_sender().prevalence
+severity: "informational"
diff --git a/insights/sender/profile_any_malicious_or_spam.yml b/insights/sender/profile_any_malicious_or_spam.yml
new file mode 100644
index 00000000000..fed3a8fe256
--- /dev/null
+++ b/insights/sender/profile_any_malicious_or_spam.yml
@@ -0,0 +1,5 @@
+name: "Sender previously flagged as malicious or spam"
+type: "query"
+source: |
+  profile.by_sender().any_messages_malicious_or_spam == true
+severity: "high"