type.inbound
and any(body.links,
.href_url.domain.domain == 'myalumni.mcgill.ca'
and .href_url.path =~ '/redirect.aspx'
)
and any(body.links, strings.ilike(.href_url.query_params, '*tokenUrl=*'))
and sender.email.domain.root_domain != 'mcgill.ca'
Playground
Test against your own EMLs or sample data.