negate Advertising and Promotions

Author: D-Bolton

detection-rules/abuse_wix_mass_mailer.yml

@@ -4,6 +4,9 @@ type: "rule"
 severity: "low"
 source: |
   type.inbound
+  and not any(ml.nlu_classifier(body.current_thread.text).topics,
+            .name == 'Advertising and Promotions' and .confidence == 'high'
+  )
   and any(filter(body.links, 'wix' in .href_url.rewrite.encoders),
           .href_url.domain.root_domain in $bulk_mailer_url_root_domains
   )