type.inbound
and length(body.links) < 20
and any(body.links, .href_url.domain.root_domain == "riddle.com")
and length(filter(body.links,
.href_url.domain.root_domain == "riddle.com"
and strings.istarts_with(.href_url.path, '/view/')
)
) == 1
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not profile.by_sender_email().any_messages_benign
Playground
Test against your own EMLs or sample data.