Attachment: EML with SharePoint files shared from GoDaddy federated tenants

type.inbound
and length(filter(attachments,
                  .file_extension == "eml" or .content_type == "message/rfc822"
           )
) == 1
and any(attachments,
        any(file.parse_eml(.).body.links,
            strings.starts_with(.href_url.domain.subdomain, 'netorg')
            and .href_url.domain.root_domain == "sharepoint.com"
        )
)