type.inbound
and any(body.links,
.href_url.domain.domain == "storage.googleapis.com"
and regex.contains(.href_url.fragment,
'[?&]od=[0-9][a-z]{2,3}[0-9A-Za-z_]*[./][0-9a-z]{6,7}[./][a-z]{0,3}[A-Z][0-9a-z]{10,24}_x[a-z]{0,3}\d{3,5}[a-z]{0,3}[./][0-9a-z]{5}[A-Za-z0-9+/_\]]{14,}'
)
)
Playground
Test against your own EMLs or sample data.