Common snippets

not profile.by_sender().solicited

profile.by_sender().prevalence in ("new")

and (
    (
      profile.by_sender().prevalence in ("new", "outlier")
      and not profile.by_sender().solicited
    )
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_false_positives
    )
)

any(body.links,
	.href_url.domain.subdomain is not null
	and .href_url.domain.subdomain != "www"
	and .href_url.domain.root_domain in $free_subdomain_hosts
)

any(body.links, .href_url.domain.domain in $free_file_hosts)

  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and (
        any(distinct(headers.hops, .authentication_results.dmarc is not null),
            strings.ilike(.authentication_results.dmarc, "*fail")
        )
      )
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )

any(body.links, .href_url.domain.root_domain in $url_shorteners)

any(body.links,

    .href_url.domain.root_domain not in $tranco_1m
    or (
        // free subdomain URL
        .href_url.domain.subdomain is not null
        and .href_url.domain.subdomain != "www"
        and .href_url.domain.root_domain in $free_subdomain_hosts
    )
)

any(body.links,

    .href_url.domain.domain in (
     "foo.com",
     "foobar.com"
    )
)

// exclude emails to support aliases
not any([recipients.to, recipients.cc, recipients.bcc], 
    any(., .email.email in $support_email_aliases)
)

not mailbox.email.email in ("[email protected]")

mailbox.email.email in $highly_targeted_user_email_addresses

any(body.links,
        // is the recipient's email address in the URL?
        // this method accounts for any encoding we might encounter
        // in the query_params
        any(recipients.to,
          strings.icontains(..href_url.url, .email.local_part)
          and strings.icontains(..href_url.url, .email.domain.domain)
        )
    )

// has an emoji in the subject or body
and (
    regex.contains(body.plain.raw, '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]')
    or regex.contains(subject.subject, '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]')
)

any(recipients.to, any($finance_users, .email == ..email.email))

sender.email.email == "[email protected]"

any(attachments, .file_name == "foo.txt")

any(attachments,
    .file_type == "pdf"
    and strings.icontains(.file_name, "foobar")
)

type.outbound
and any(recipients.to, .email.email == "[email protected]")

strings.istarts_with(headers.mailer, "Foo")

strings.contains(body.current_thread.text, "foo bar")

strings.icontains(body.current_thread.text, "foo bar")

any(body.links, .href_url.domain.tld == "ru")

sender.email.email != headers.return_path.email

regex.icontains(subject.subject, "foo.*bar")

any(recipients.to, .email.email == "[email protected]")

any(headers.hops, .authentication_results.dmarc == "fail")

any(headers.hops, .authentication_results.spf == "fail")

// display name is within 3 character substitutions of "Jane Doe"
strings.ilevenshtein(sender.display_name, "Jane Doe") < 3

// don't match exact org domain matches
sender.email.domain.domain not in $org_domains
// sender's display name is within 3 character substitutions of a specific hard-coded domain
and strings.levenshtein(sender.email.domain.domain, "foo.com") < 3

// don't match exact org domain matches
sender.email.domain.domain not in $org_domains
// sender's display name is within 3 character substitutions of a known org domain
and any($org_domains, strings.levenshtein(sender.email.domain.domain, .) < 3)

// [email protected] is on the to, cc, or bcc line
any([recipients.to, recipients.cc, recipients.bcc], 
    any(., .email.email == "[email protected]")
)