type.inbound
and sender.email.email == "message@adobe.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass
and any(html.xpath(body.html,
"//td[@style[contains(., 'adobe-clean-display')]]/strong/a/text()"
).nodes,
strings.parse_email(.raw).domain.root_domain not in $org_domains
and strings.parse_email(.raw).email not in $recipient_emails
and strings.parse_email(.raw).email not in $sender_emails
and not (
strings.parse_email(.raw).domain.domain not in $free_email_providers
and strings.parse_email(.raw).domain.domain in $recipient_domains
and strings.parse_email(.raw).domain.domain in $sender_domains
)
)
Playground
Test against your own EMLs or sample data.