type.inbound
and any(filter(attachments, .file_type == "pdf"),
any(file.explode(.),
any(.scan.strings.strings, . =~ 'VIEW RFP DOCUMENT')
)
and any(file.explode(.),
length(filter(.scan.url.urls,
.scheme != "mailto"
and .domain.domain != sender.email.domain.domain
)
) > 0
)
)
Playground
Test against your own EMLs or sample data.