type.inbound
and length(filter(attachments, .file_type == "pdf")) >= 1
and any(attachments,
.file_type == "pdf"
and any(file.explode(.),
any(.scan.url.urls,
strings.icontains(.path,
strings.concat("/:o:/p/",
sender.email.local_part
)
)
or strings.icontains(.path, "/:o:/g/personal/")
)
)
)
Playground
Test against your own EMLs or sample data.