type.inbound
and any(body.links,
.href_url.domain.root_domain == "toradex.com"
and strings.icontains(.href_url.path, '/service/share')
// the redirect only fires when both params are present
and regex.icontains(.href_url.query_params, '(?:^|&)target=')
and regex.icontains(.href_url.query_params, '(?:^|&)url=')
// negate use of the redirect by toradex
and not regex.icontains(.href_url.query_params,
'(?:^|&)url=[^&]*toradex\.com'
)
)
Playground
Test against your own EMLs or sample data.