New link domain (<=10d) from untrusted sender

type.inbound
and length(body.links) > 0
and any(body.links,
        network.whois(.href_url.domain).days_old <= 10
        // Mimecast link logic
        or (
          .href_url.domain.root_domain in (
            "mimecastprotect.com",
            "mimecast.com"
          )
          and any(.href_url.query_params_decoded['domain'],
                  network.whois(strings.parse_domain(.)).days_old <= 10
          )
        )
)
and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or profile.by_sender().any_messages_malicious_or_spam
)
// negate senders which have had previous messages marked as benign which pass auth
and not (
  profile.by_sender().any_messages_benign
  and profile.by_sender().auth_failed == false
)