type.inbound
and sender.email.domain.domain == 'messaging.microsoft.com'
and any(filter(body.current_thread.links, .href_url.scheme != 'mailto'),
strings.contains(.href_url.url, recipients.to[0].email.domain.domain)
// CF Turnstile
and any(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
.domain.domain == "challenges.cloudflare.com"
)
)
Playground
Test against your own EMLs or sample data.