Attachment: ICS calendar file with suspicious product identifier

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and (
          regex.icontains(beta.file.parse_ics(.).product_id,
                          '-//[a-z0-9]*[0-9][a-z0-9]*//EN'
          )
          or strings.icontains(beta.file.parse_ics(.).product_id,
                               "-//MyApp//example.com//",
                               "-//My App//NS9 Calendar//EN",
                               "-//SharePoint//NONSGML v1.0//EN",
                               "-//YourCassavaLtd//EateriesDept//EN",
                               "-//Your App//EN",
                               "-//Organization//EN",
                               "-//Calendar Auto//EN",
                               "-Meeting Schedule",
                               "-//JANSANI//Email Engine v12.7//EN",
                               "-Event Mandate",
                               "-//CalendarInviteBuilder//EN",
                               "-//CustomMailer//EN",
                               "Trafft",
                               "-//caldav.icloud.com//CALDAVJ 2620B879//EN",
                               "-//Calendar Event//EN",
                               "-//dilmar//EN",
                               "-//First Dips//Portal//EN",
                               "-//X7fG3//Y2kL9//M9nP4 16.0 MIMEDIR//EN",
                               "-//HRNotify//CompChange 1.0//EN",
                               "-//Prof Morales Sender//EN",
                               "//NONSGML Event//EN"
          )
        )
)