beta.DLP: MAC Address

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "mac_address" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "mac_address" and .confidence in ("medium", "high")
  )
  or any(attachments,
    any(file.explode(.),
      (
        any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
          .type == "mac_address" and .confidence in ("medium", "high")
        )
        or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
          .type == "mac_address" and .confidence in ("medium", "high")
        )
      )
    )
  )
)