type.inbound
and all(recipients.to, .email.domain.domain == "groups.outlook.com")
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "callback_scam" and .confidence != "low"
)
and not (
length(recipients.to) == 0 or all(recipients.to, .email.domain.valid == false)
)
Playground
Test against your own EMLs or sample data.