Link: SharePoint files shared from GoDaddy federated tenants

type.inbound
// Matches the message id observed. DKIM/SPF domains can be custom and therefore are unpredictable.
and strings.starts_with(headers.message_id, '<Share-')
and strings.ends_with(headers.message_id, '@odspnotify>')

// subject matches the default "shared <filename> with you" format
and strings.ends_with(subject.subject, ' with you')

// any of the links are the default netorgft name from GoDaddy
and any(body.links,
        // Default GoDaddy tenant names
        strings.starts_with(.href_url.domain.subdomain, 'netorg')
        and .href_url.domain.root_domain == "sharepoint.com"
)

// and sender has never had email sent to them
and not profile.by_sender().solicited

// and there haven't been any FPs reported for the sender
and not profile.by_sender().any_messages_benign