type.inbound
and network.whois(sender.email.domain).days_old < 180
and any([body.html.display_text, subject.base],
regex.icontains(., '\$\d\p{Pd}\$\d{1,2}(?:m\b|million)')
)
Playground
Test against your own EMLs or sample data.
type.inbound
and network.whois(sender.email.domain).days_old < 180
and any([body.html.display_text, subject.base],
regex.icontains(., '\$\d\p{Pd}\$\d{1,2}(?:m\b|million)')
)
Test against your own EMLs or sample data.