type.inbound
and any(filter(attachments, .file_type == "pdf"),
any(file.explode(.),
any(.scan.yara.matches,
// yara rule matches on an embedded SAI Global logo that allows for resized versions of the image
.name == "SAI_Global_ISO9001_Logo_PDF_Fuzzy"
)
)
)
Playground
Test against your own EMLs or sample data.