Attachment: ICS calendar invite with bid/RFP lure and suspicious link

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                regex.icontains(.description,
                                'invite\s+(?:your\s+)?company\s+to\s+participate\s+in\s+(?:the\s+)?bidding\s+process',
                                'pre-bid\s+meeting\s+to\s+present\s+(?:the\s+)?project\s+scope',
                                'access\s+the\s+[0-9]{4}\s+bid\s+documents',
                                'RFI-[0-9]{2}-[0-9]{4}-[0-9]{3}',
                                'bid\s+(?:document|package)\s*[,–-]\s*RFI',
                                'complete\s+bid\s+package.{0,30}including\s+all\s+relevant\s+documents',
                                'invite.{0,20}(?:company|organization|firm|business).{0,30}(?:participate|partake).{0,30}(?:bid|proposal|RFP|RFQ|financial\s+review)',
                                '(?:evaluate|review|assess).{0,30}(?:proposals?|RFPs?|RFQs?).{0,30}(?:financial|accounting)'
                )
        )
)
and any(body.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
        and (
          .href_url.domain.root_domain in $self_service_creation_platform_domains
          or .href_url.domain.domain in $self_service_creation_platform_domains
          or .href_url.domain.root_domain in $free_file_hosts
          or .href_url.domain.domain in $free_file_hosts
          or .href_url.domain.root_domain in $free_subdomain_hosts
          or .href_url.domain.domain in $free_subdomain_hosts
          or .href_url.domain.tld in $suspicious_tlds
          or .href_url.domain.domain in $url_shorteners
          or .href_url.domain.root_domain in $url_shorteners
          or network.whois(.href_url.domain).days_old < 90
          or regex.icontains(.display_text,
                             '(?:review|view|open|access|download)\W+(?:bid|proposal|document|rfp|rfq|tender)'
          )
        )
)