Link: Intuit link abuse with file share context

type.inbound
// look for links to links.notification.intuit.com but the sender is not from quickbooks/intuit
and any(body.links, .href_url.domain.domain == "links.notification.intuit.com")
and sender.email.domain.root_domain not in ("quickbooks.com", "intuit.com")
// check to see if it is classified as cred_theft
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft") and .confidence != "low"
)
and length(body.current_thread.text) < 1750
// check to see if the topic is File Sharing & Cloud Services
and any(beta.ml_topic(body.current_thread.text).topics,
        .name == "File Sharing and Cloud Services" and .confidence != "low"
)