type.inbound
and any(body.links,
.href_url.domain.domain == "storage.googleapis.com"
and regex.match(.href_url.fragment, '[A-Za-z0-9+/]{100,160}={0,2}')
and regex.match(strings.decode_base64(.href_url.fragment,
ignore_padding=true
),
'[A-Za-z0-9+/]{80,120}={0,2}'
)
)
Playground
Test against your own EMLs or sample data.