Service abuse: Suspicious Datadog alert

type.inbound
and sender.email.email == "alert@dtdg.co"
and length(body.current_thread.text) < 1000
and (
  (
    any(filter(body.links,
               .parser == "hyperlink"
               and not any(.href_url.query_params_decoded["domain"],
                           strings.parse_domain(.).root_domain == "datadoghq.com"
               )
        ),
        .href_url.domain.root_domain != "datadoghq.com"
        and .href_url.domain.root_domain != "aka.ms"
    )
    and regex.icontains(body.current_thread.text,
                        'quarantine|held for.{0,10}review|secure message|voice\s?mail'
    )
  )
  or (
    ml.nlu_classifier(body.current_thread.text).language == "english"
    and any(ml.nlu_classifier(body.current_thread.text).topics,
            .confidence == "high"
            and .name == "Voicemail Call and Missed Call Notifications"
    )
  )
)