type.inbound
and any(map(filter(body.previous_threads,
.sender.display_name != ""
and any($org_vips,
strings.icontains(..sender.display_name,
.display_name
)
)
// a To:/From: line whose <...> repeats the display name ("Jane Doe<Jane Doe>")
and any(regex.extract(.preamble,
'(?i)(?:to|from)\s*:\s*(?P<dn>[^<\n]*[a-z][^<\n]*?)\s*<\s*(?P<inner>[^@<>\n/]*[a-z][^@<>\n/]*?)\s*>'
),
strings.icontains(.named_groups["dn"],
.named_groups["inner"]
)
or strings.icontains(.named_groups["inner"],
.named_groups["dn"]
)
// or the brackets hold the org's brand instead of an address ("Jane Doe <Acme>");
// exact match, since substring would let short brands hit any word
or .named_groups["inner"] in~ $org_brand_names
)
),
.sender.display_name
),
// that VIP's real address is absent from the live recipients and sender
not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
any($org_vips,
strings.icontains(..., .display_name)
and .email != ""
and strings.icontains(..email.email, .email)
)
)
and not any($org_vips,
strings.icontains(.., .display_name)
and .email != ""
and strings.icontains(sender.email.email, .email)
)
)
and not (
sender.email.domain.root_domain in $org_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Playground
Test against your own EMLs or sample data.