type.inbound
and any(map(filter(body.previous_threads,
.sender.email.email == ""
and .sender.display_name != ""
and any($org_vips,
strings.icontains(..sender.display_name,
.display_name
)
)
and not coalesce(.subject.is_auto_reply, false)
and any(recipients.to,
.email.domain.root_domain in $org_domains
and strings.icontains(..text, .email.email)
)
and regex.icontains(.text,
'accounts? payable',
'(?:forward|send|rout|direct|remit|submit|issue) (?:it|a copy) (?:directly )?to',
'(?:forward|send|direct|remit|submit|route) (?:the |all |related )?(?:invoice|correspondence|payment|billing)',
'for payment processing,? please contact',
'(?:please )?direct (?:it|all|the)[^\n]{0,60}\bto\b',
'directed to (?:our |the )?[^\n]{0,40}(?:team|processing)',
'(?:as follows|provided below|find below|details are|contact is)[^\n]{0,10}:',
'billing (?:contact|correspondence|team|department|statements?)'
)
),
.sender.display_name
),
. != ""
and any(filter(body.previous_threads, .sender.display_name == ..),
any(ml.nlu_classifier(.text, subject=.subject.base).tags,
.name in ("invoice", "payment") and .confidence != "low"
)
or any(ml.nlu_classifier(.text, subject=.subject.base).topics,
.name in (
"Request to View Invoice",
"Payment Information"
)
and .confidence != "low"
)
)
and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
any($org_vips,
strings.icontains(..., .display_name)
and .email != ""
and strings.icontains(..email.email, .email)
)
)
)
and length(filter(flatten([recipients.to, recipients.cc, recipients.bcc]),
.email.domain.root_domain in $org_domains
)
) == 1
and not (
sender.email.domain.root_domain in $org_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Playground
Test against your own EMLs or sample data.