type.inbound
and any(ml.nlu_classifier(body.current_thread.text).entities,
.name == "sender" and strings.icontains(.text, "Google Authenticator")
)
and not (
sender.email.domain.root_domain in ("google.com", "okta.com")
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Playground
Test against your own EMLs or sample data.