This rule detects inbound emails attempting to impersonate Sedgwick Claims Management Services. It triggers when the inbound message matches either: (1) the sender display_name contains the string 'Sedgwick Claim', or (2) a combination of NLU-derived indicators—an entity labeled as the sender recognized as 'Sedgwick' and a high-confidence topic 'Financial Communications'—along with at least one link in the message whose display_text contains 'claim'. Legitimate Sedgwick-origin messages that pass DMARC are excluded by ensuring the sender's root_domain is not sedgwick.com or sedgwickcms.com with DMARC pass. The rule analyzes inbound content using: sender.display_name, body.current_thread.text, body.links, and DMARC headers, leveraging NLU to extract entities and topics and header analysis to assess DMARC status. It is mapped to attack types BEC/Fraud and Credential Phishing, with tactics focused on Impersonation: Brand, Spoofing, and Social engineering. Detection is reinforced by combining sender analysis, header checks, and natural language understanding to reduce false positives while guarding against high-signal brand-impersonation attempts.