Attachment: ICS calendar file with QR code containing recipient email address

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or (
            .file_extension == "ics"
            or .content_type in ("application/ics", "text/calendar")
          )
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                //
                // This rule makes use of a beta feature and is subject to change without notice
                // using the beta feature in custom rules is not suggested until it has been formally released
                //
                any(beta.scan_qr(file.html_screenshot(.description_html)).items,
                    strings.icontains(.url.url, recipients.to[0].email.email)
                    or any(strings.scan_base64(.url.url, format="url"),
                           strings.icontains(., recipients.to[0].email.email)
                    )
                    or any(strings.scan_base64(.url.fragment),
                           strings.icontains(., recipients.to[0].email.email)
                    )
                )
        )
)