Attachment: ICS file with excessive custom properties

type.inbound
and any(filter(attachments,
               .file_type in~ ('ics')
               or .content_type in ("text/calendar", "application/ics")
        ),
        regex.icount(file.parse_text(.).text,
                     '[\r\n]X-[^\r\n]+\x3b\s?[^\r\n]+:\s*[a-f0-9]{32,}'
        ) > 10
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        or any(beta.file.parse_ics(.).events,
               length(filter(.raw_properties,
                             strings.istarts_with(.key, 'X-')
                             and regex.icontains(.value, '^[a-f0-9]{32,}$')
                      )
               ) > 10
        )
)