Link: Monday hosted link with suspicious content

type.inbound
// exactly one unique monday.com URL scoped to subdomain hyperlink
and any(body.current_thread.links,
        // monday service has been observed encoding mailto links as urls
        .href_url.scheme != "mailto"
        // ignore plain text links
        and .parser != "plain"
        and .href_url.domain.root_domain == "monday.com"
        and .href_url.domain.subdomain in ("forms", "view")
        // negate benign form requests
        and not regex.icontains(ml.link_analysis(., mode="aggressive").final_dom.raw,
                                '\bquestionnaire\b',
                                '\bquote\b',
                                '\brequest\b',
                                '\bwork order\b'
        )
)

// suspicious indicators
and (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name == "Secure Message" and .confidence == "high"
  )
  or any(ml.nlu_classifier(body.current_thread.text).topics,
         .name == "E-Signature" and .confidence == "high"
  )

  // file share nlu with cred theft indicators
  or (
    any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "File Sharing and Cloud Services" and .confidence == "high"
    )
    and any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "cred_theft" and .confidence == "high"
    )
  )
)

// negate legitimate replies
and not (
  (length(headers.references) > 0 or headers.in_reply_to is not null)
  and (subject.is_forward or subject.is_reply)
  and length(body.previous_threads) >= 1
)