Service abuse: Trello board invitation with VIP impersonation

type.inbound
and sender.email.domain.root_domain == "trello.com"
// inspect the hops for two observed patterns
and any(headers.hops,
        any(.fields,
            // X-Msys-Api with campaign_id
            (
              .name =~ "X-Msys-Api"
              and strings.icontains(.value, 'campaign_id":"invite_board_')
            )
            // X-Atl-Po-Triggerid with trello and invite board
            or (
              .name == "Feedback-Id"
              and strings.icontains(.value, 'trello')
              and regex.icontains(.value, 'invite[_-]board')
            )
        )
)

// inspect the body for two observed patterns
and (
  // org_sld as the start of the board name with the org_vip as the sender
  any(html.xpath(body.html, '//h2').nodes,
      // org vip
      any($org_vips, strings.icontains(..display_text, .display_name))
      and (
        // org sld as the board name
        any($org_slds,
            strings.icontains(..display_text,
                              strings.concat('invited you to their board ', .)
            )
        )
        // extract board owner email, check it's not a known org email
        or any(regex.iextract(.display_text,
                              '([a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,})'
               ),
               not (
                 .full_match in $sender_emails
                 or .full_match in $recipient_emails
               )
        )
        or strings.replace_confusables(.display_text) != .display_text
      )
  )
  // pattern of the first name ending in `From` after the org_vip display name
  or any(html.xpath(body.html,
                    '//div[img[@class="trello-member-avatar"]]/parent::div'
         ).nodes,
         strings.starts_with(.display_text, 'A note from ')
         and strings.iends_with(.display_text, 'From')
         and any($org_vips, strings.icontains(..display_text, .display_name))
  )
)