Attachment: Fake voicemail via PDF

type.inbound
// a single PDF attachment
and length(attachments) == 1
// the subject doesn't contain fax, which is currently a common match for the topic
and not strings.icontains(subject.base, 'fax')
and (
  length(body.current_thread.text) == 0
  or (
    ml.nlu_classifier(body.current_thread.text).language == "english"
    and (
      any(ml.nlu_classifier(body.current_thread.text).topics,
          .confidence == "high"
          and .name == "Voicemail Call and Missed Call Notifications"
      )
      or any(ml.nlu_classifier(body.current_thread.text).intents,
             .confidence == "high" and .name == "bec"
      )
    )
  )
)
// the Topic analysis of the PDF is Voicemail
and any(attachments,
        .file_extension == "pdf"
        // the NLU detected language is english
        and ml.nlu_classifier(beta.ocr(.).text).language == "english"
        and length(beta.ocr(.).text) > 95
        and any(ml.nlu_classifier(beta.ocr(.).text).topics,
                .confidence == "high"
                and .name == "Voicemail Call and Missed Call Notifications"
        )
        and beta.ocr(.).success
        // contains a link or QR code
        and any(file.explode(.),
                0 < length(.scan.pdf.urls) <= 2 or .scan.qr.url.url is not null
        )
        // there is only a single page
        and any(file.explode(.), .depth == 0 and .scan.exiftool.page_count == 1)
)
and not (
  sender.email.domain.root_domain == "zendesk.com"
  and coalesce(headers.auth_summary.dmarc.pass, false)
)