type.inbound
and any(attachments,
.file_extension == "ics"
and strings.ilike(file.parse_text(.).text,
'*ATTACH;ENCODING=*;VALUE=BINARY*'
)
and (
strings.ilike(file.parse_text(.).text, '*FILENAME=*.doc*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.dot*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.pp*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.wbk*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.xl*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.html*')
)
)
Playground
Test against your own EMLs or sample data.