type.inbound
and any(body.links,
// storage.googleapis.com
.href_url.domain.domain == "storage.googleapis.com"
// observed pattern in actor controlled url path
and regex.contains(.href_url.path,
'^\/[a-z0-9]+-[a-z0-9]+-\d{8}\-[0-9a-f]+\/[^\.]+\.html'
)
)
Playground
Test against your own EMLs or sample data.