Updating to use current_thread

signals/content/nlu_bec_high_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Business Email Compromise - High Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "bec" and .confidence == "high")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec" and .confidence == "high")
 tags:
   - "Natural Language Understanding"
   - "Business Email Compromise"

signals/content/nlu_bec_low_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Business Email Compromise - Low Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "bec" and .confidence == "low")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec" and .confidence == "low")
 tags:
   - "Natural Language Understanding"
   - "Business Email Compromise"

signals/content/nlu_bec_med_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Business Email Compromise - Medium Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "bec" and .confidence == "medium")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec" and .confidence == "medium")
 tags:
   - "Natural Language Understanding"
   - "Business Email Compromise"

signals/content/nlu_benign_high_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Benign - High Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "benign" and .confidence == "high")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "benign" and .confidence == "high")
 tags:
   - "Natural Language Understanding"
-  - "Benign"
+  - "Benign"

signals/content/nlu_benign_low_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Benign - Low Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "benign" and .confidence == "low")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "benign" and .confidence == "low")
 tags:
   - "Natural Language Understanding"
-  - "Benign"
+  - "Benign"

signals/content/nlu_benign_medium_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Benign - Medium Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "benign" and .confidence == "medium")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "benign" and .confidence == "medium")
 tags:
   - "Natural Language Understanding"
   - "Benign"

signals/content/nlu_callback_scam_high_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Callback Scam - High Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "callback_scam" and .confidence == "high")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "callback_scam" and .confidence == "high")
 tags:
   - "Natural Language Understanding"
   - "Callback Scam"

signals/content/nlu_callback_scam_low_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Callback Scam - Low Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "callback_scam" and .confidence == "low")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "callback_scam" and .confidence == "low")
 tags:
   - "Natural Language Understanding"
   - "Callback Scam"

signals/content/nlu_callback_scam_medium_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Callback Scam - Medium Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "callback_scam" and .confidence == "medium")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "callback_scam" and .confidence == "medium")
 tags:
   - "Natural Language Understanding"
   - "Callback Scam"

signals/content/nlu_credtheft_high_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Credential Theft - High Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "cred_theft" and .confidence == "high")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "cred_theft" and .confidence == "high")
 severity: "medium"
 tags:
   - "Natural Language Understanding"

signals/content/nlu_credtheft_low_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Credential Theft - Low Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "cred_theft" and .confidence == "low")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "cred_theft" and .confidence == "low")
 severity: "medium"
 tags:
   - "Natural Language Understanding"

signals/content/nlu_credtheft_med_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Credential Theft - Medium Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "cred_theft" and .confidence == "medium")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "cred_theft" and .confidence == "medium")
 severity: "medium"
 tags:
   - "Natural Language Understanding"

signals/content/nlu_extortion_high_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Extortion - High Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "extortion" and .confidence == "high")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "extortion" and .confidence == "high")
 severity: "medium"
 tags:
   - "Natural Language Understanding"

signals/content/nlu_extortion_low_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Extortion - Low Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "extortion" and .confidence == "low")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "extortion" and .confidence == "low")
 severity: "medium"
 tags:
   - "Natural Language Understanding"

signals/content/nlu_extortion_med_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Extortion  - Medium Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "extortion" and .confidence == "medium")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "extortion" and .confidence == "medium")
 severity: "medium"
 tags:
   - "Natural Language Understanding"

signals/content/nlu_financial_entity.yml

@@ -1,7 +1,7 @@
 name: "NLU Entity: Financial"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).entities, .name == "financial")
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "financial")
 tags:
   - "Natural Language Understanding"
 

signals/content/nlu_greeting_entity.yml

@@ -1,7 +1,7 @@
 name: "NLU Entity: Greeting"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).entities, .name == "greeting")
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "greeting")
 tags:
   - "Natural Language Understanding"
 

signals/content/nlu_invoice_high_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Tag: Invoice - High Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).tags, .name == "invoice" and .confidence == "high")
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "invoice" and .confidence == "high")
 tags:
   - "Natural Language Understanding"
   - "Invoice"

signals/content/nlu_invoice_low_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Tag: Invoice - Low Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).tags, .name == "invoice" and .confidence == "low")
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "invoice" and .confidence == "low")
 tags:
   - "Natural Language Understanding"
   - "Invoice"

signals/content/nlu_invoice_medium_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Tag: Invoice - Medium Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).tags, .name == "invoice" and .confidence == "medium")
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "invoice" and .confidence == "medium")
 tags:
   - "Natural Language Understanding"
   - "Invoice"

signals/content/nlu_job_scam_high_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Job Scam - High Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "job_scam" and .confidence == "high")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "job_scam" and .confidence == "high")
 tags:
   - "Natural Language Understanding"
   - "Job Scam"

signals/content/nlu_job_scam_low_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Job Scam - Low Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "job_scam" and .confidence == "low")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "job_scam" and .confidence == "low")
 tags:
   - "Natural Language Understanding"
   - "Job Scam"

signals/content/nlu_job_scam_medium_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Job Scam - Medium Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "job_scam" and .confidence == "medium")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "job_scam" and .confidence == "medium")
 tags:
   - "Natural Language Understanding"
   - "Job Scam"

signals/content/nlu_org_entity.yml

@@ -1,7 +1,7 @@
 name: "NLU Entity: Organization"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).entities, .name == "org")
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "org")
 tags:
   - "Natural Language Understanding"
 

signals/content/nlu_payment_high_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Tag: Payment - High Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).tags, .name == "payment" and .confidence == "high")
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "payment" and .confidence == "high")
 tags:
   - "Natural Language Understanding"
   - "Payment"

signals/content/nlu_payment_low_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Tag: Payment - Low Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).tags, .name == "payment" and .confidence == "low")
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "payment" and .confidence == "low")
 tags:
   - "Natural Language Understanding"
   - "Payment"

signals/content/nlu_payment_medium_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Tag: Payment - Medium Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).tags, .name == "payment" and .confidence == "medium")
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "payment" and .confidence == "medium")
 tags:
   - "Natural Language Understanding"
   - "Payment"

signals/content/nlu_purchase_order_high_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Tag: Purchase Order - High Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).tags, .name == "purchase_order" and .confidence == "high")
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "purchase_order" and .confidence == "high")
 tags:
   - "Natural Language Understanding"
   - "Purchase Order"

signals/content/nlu_purchase_order_low_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Tag: Purchase Order - Low Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).tags, .name == "purchase_order" and .confidence == "low")
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "purchase_order" and .confidence == "low")
 tags:
   - "Natural Language Understanding"
   - "Purchase Order"

signals/content/nlu_purchase_order_medium_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Tag: Purchase Order - Medium Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).tags, .name == "purchase_order" and .confidence == "medium")
+  any(ml.nlu_classifier(body.current_thread.text).tags, .name == "purchase_order" and .confidence == "medium")
 tags:
   - "Natural Language Understanding"
   - "Purchase Order"

signals/content/nlu_recipient_entity.yml

@@ -1,7 +1,7 @@
 name: "NLU Entity: Recipient"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).entities, .name == "recipient")
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "recipient")
 tags:
   - "Natural Language Understanding"
 

signals/content/nlu_request_entity.yml

@@ -1,7 +1,7 @@
 name: "NLU Entity: Request"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).entities, .name == "request")
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "request")
 tags:
   - "Natural Language Understanding"
 

signals/content/nlu_salutation_entity.yml

@@ -1,7 +1,7 @@
 name: "NLU Entity: Salutation"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).entities, .name == "salutation")
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "salutation")
 tags:
   - "Natural Language Understanding"
 

signals/content/nlu_sender_entity.yml

@@ -1,7 +1,7 @@
 name: "NLU Entity: Sender"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).entities, .name == "sender")
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "sender")
 tags:
   - "Natural Language Understanding"
 

signals/content/nlu_steal_pii_high_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Steal PII - High Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "steal_pii" and .confidence == "high")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "steal_pii" and .confidence == "high")
 tags:
   - "Natural Language Understanding"
   - "Steal PII"

signals/content/nlu_steal_pii_low_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Steal PII - Low Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "steal_pii" and .confidence == "low")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "steal_pii" and .confidence == "low")
 tags:
   - "Natural Language Understanding"
   - "Steal PII"

signals/content/nlu_steal_pii_medium_conf.yml

@@ -1,7 +1,7 @@
 name: "NLU Intent: Steal PII - Medium Confidence"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents, .name == "steal_pii" and .confidence == "medium")
+  any(ml.nlu_classifier(body.current_thread.text).intents, .name == "steal_pii" and .confidence == "medium")
 tags:
   - "Natural Language Understanding"
   - "Steal PII"

signals/content/nlu_urgency_entity.yml

@@ -1,7 +1,7 @@
 name: "NLU Entity: Urgency"
 type: "query"
 source: |
-  any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).entities, .name == "urgency")
+  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency")
 tags:
   - "Natural Language Understanding"