type.inbound
and any(body.current_thread.links,
strings.ends_with(.display_text,
'.xlsx',
'.xls',
'.pdf',
'.doc',
'.docx'
)
and network.whois(ml.link_analysis(., mode="aggressive").effective_url.domain
).days_old <= 30
)
Playground
Test against your own EMLs or sample data.