type.inbound
and any(attachments,
.file_extension in~ $file_extensions_common_archives
and any(file.explode(.),
.depth > 0 and .file_extension in~ ("html", "htm")
)
)
and (
not profile.by_sender().solicited
or (profile.by_sender().any_messages_malicious_or_spam)
)
and not profile.by_sender().any_messages_benign
Playground
Test against your own EMLs or sample data.