type.inbound
and any(body.links,
.href_url.domain.root_domain == 'vk.com'
and strings.iends_with(.href_url.path, '/away.php')
)
and sender.email.domain.root_domain != 'vk.com'
Playground
Test against your own EMLs or sample data.
type.inbound
and any(body.links,
.href_url.domain.root_domain == 'vk.com'
and strings.iends_with(.href_url.path, '/away.php')
)
and sender.email.domain.root_domain != 'vk.com'
Test against your own EMLs or sample data.