Brand impersonation: Gusto

type.inbound
and (
  strings.ilike(sender.display_name, '*gusto*')
  or strings.ilevenshtein(sender.display_name, 'gusto') <= 1
  or strings.ilike(sender.email.domain.domain, '*gusto*')
)
and any(ml.logo_detect(file.message_screenshot()).brands,
        .name == "Gusto" and .confidence in ("medium", "high")
)
and sender.email.domain.root_domain !~ 'gusto.com'

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)