type.inbound
and any(attachments,
(
.file_extension in~ ('ics')
or .content_type in ("application/ics", "text/calendar")
)
and (
regex.icontains(file.parse_text(.).text, 'lambda-url')
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
or any(beta.file.parse_ics(.).events,
any(.links,
strings.icontains(.href_url.domain.domain, "lambda-url")
)
)
)
)
Playground
Test against your own EMLs or sample data.