Brand impersonation: SiriusXM

type.inbound
and (
  strings.ilike(sender.display_name, '*siriusxm*')
  or strings.ilevenshtein(sender.display_name, 'siriusxm') <= 1
  or strings.ilike(sender.email.domain.domain, '*siriusxm*')
)
and (
  sender.email.domain.root_domain not in (
    'siriusxm.com',
    'siriusxmmedia.com',
    'siriusxm.ca',
    'engagement360.net', // SiriusXM survey vendor
    'sciquest.com' // SiriusXM Procurement
  )
  or (
    sender.email.domain.root_domain in (
      'siriusxm.com',
      'siriusxmmedia.com',
      'siriusxm.ca',
      'engagement360.net', // SiriusXM survey vendor
      'sciquest.com' // SiriusXM Procurement
    )
    and not headers.auth_summary.dmarc.pass
  )
)
and not profile.by_sender().solicited