type.inbound
// self sender or invaild recipent domain
and length(recipients.to) == 1
and (
sender.email.email == recipients.to[0].email.email
or recipients.to[0].email.domain.valid == false
)
and any(filter(attachments, .file_type == "pdf"),
strings.starts_with(beta.parse_exif(.).title, "127.0.0.1")
)
Playground
Test against your own EMLs or sample data.