Brand impersonation: ADP

type.inbound
and sender.display_name in~ (
  'RS-Plan-Admin@adp.com',
  'ADP',
  'SecurityServices_NoReply@adp.com'
)
and sender.email.domain.root_domain not in~ (
  'adp.com',
  'adpsurveys.com',
  'adp.com.br'
)
and sender.email.email not in $recipient_emails