Attachment: ICS with employee policy review lure

type.inbound
and any(filter(attachments,
               .file_type in~ ('ics')
               or .content_type in ("text/calendar", "application/ics")
        ),
        any(file.explode(.),
            .depth == 0
            and any(.scan.strings.strings,
                    strings.icontains(., 'policy review')
            )
            and any(.scan.strings.strings,
                    strings.icontains(., 'secure access')
            )
        )
)