Service abuse: Trello board invitation with VIP impersonation

type.inbound
and sender.email.domain.root_domain == "trello.com"
and any(headers.hops,
        any(.fields,
            .name =~ "X-Msys-Api"
            and strings.icontains(.value, 'campaign_id":"invite_board_')
        )
)

// inspect the body for two observed patterns
and (
    // org_sld as the start of the board name with the org_vip as the sender
  any(html.xpath(body.html, '//h2').nodes,
      // org vip
      any($org_vips, strings.icontains(..display_text, .display_name))
      // org sld as the board name
      and any($org_slds,
              strings.icontains(..display_text,
                                strings.concat('invited you to their board ', .)
              )
      )
  )
  // pattern of the first name ending in `From` after the org_vip display name
  or any(html.xpath(body.html,
                    '//div[img[@class="trello-member-avatar"]]/parent::div'
         ).nodes,
         strings.starts_with(.display_text, 'A note from ')
         and strings.iends_with(.display_text, 'From')
         and any($org_vips, strings.icontains(..display_text, .display_name))
  )
)