type.inbound
and any(attachments,
(
.file_type == "ics"
or .file_extension == "ics"
or .content_type in ("application/ics", "text/calendar")
)
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any(beta.file.parse_ics(.).events,
(
any([.summary, .description],
regex.icontains(.,
'(?:dear|hi|hello).(?:counsel|team),',
'file attached',
'\brefer\b',
'\brespon(?:d|se)\b',
'\breview\b'
)
)
or any(.links, regex.icontains(.display_text, 'view'))
)
and any([.summary, .description],
regex.icontains(.,
'case resolution material',
'court-related',
'court.(?:subpoena|summons)',
'(?:court case|litigation).(?:document|letter)',
'formal.(?:dispute|mediation|recovery)',
'proposed counteroffer',
'paga settlement',
'settlement.(?:&|and.)?(?:brief|document|finalization|material)',
"view court order"
)
)
)
)
Playground
Test against your own EMLs or sample data.