type.inbound
and not subject .is_reply
and any(attachments, .file_extension in~ ('ics'))
and any(attachments,
any(file.explode(.),
.file_extension in~ ('ics')
and regex.icontains(.scan.strings.raw,
'[\x{E0000}-\x{E007F}\x{E0100}-\x{E01EF}\x{2062}\x{2064}]{8,}'
)
)
)
and (
regex.icontains(subject.subject, '(calendar|meeting|event|appointment)')
or regex.icontains(body.current_thread.text,
'(calendar|meeting|event|appointment)'
)
or any(attachments, .content_type in~ ("text/calendar"))
)
Playground
Test against your own EMLs or sample data.