Attachment: ICS calendar file with base64 encoded recipient address in URL parameters

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                any(filter(.links, length(.href_url.query_params_decoded) > 1),
                    any(strings.scan_base64(strings.concat(coalesce(flatten(values(.display_url.query_params_decoded
                                                                            )
                                                                    )[0],
                                                                    ""
                                                           ),
                                                           coalesce(flatten(values(.display_url.query_params_decoded
                                                                            )
                                                                    )[1],
                                                                    ""
                                                           ),
                                                           coalesce(flatten(values(.display_url.query_params_decoded
                                                                            )
                                                                    )[2],
                                                                    ""
                                                           ),
                                                           coalesce(flatten(values(.display_url.query_params_decoded
                                                                            )
                                                                    )[3],
                                                                    ""
                                                           ),
                                                           coalesce(flatten(values(.display_url.query_params_decoded
                                                                            )
                                                                    )[4],
                                                                    ""
                                                           ),
                                                           coalesce(flatten(values(.display_url.query_params_decoded
                                                                            )
                                                                    )[5],
                                                                    ""
                                                           )
                                            )
                        ),
                        . == recipients.to[0].email.email
                    )
                )
        )
)