Sharepoint file share with suspicious recipients pattern

type.inbound

// Suspicious recipient pattern
and any(recipients.to, .display_name == "Undisclosed recipients")
and strings.ilike(body.current_thread.text,
                  "*shared a file with you*",
                  "*shared with you*",
                  "*invited you to access a file*"
)
and strings.icontains(subject.subject, "shared")
and any(body.links, .href_url.domain.root_domain == "sharepoint.com")