DocuSign impersonation via CloudHQ links

type.inbound
and sender.email.domain.root_domain != 'cloudhq.net'
and any(body.links,
        .href_url.domain.root_domain == "cloudhq.net"
        and strings.starts_with(.href_url.path, "/s/")
)

// the subject or display_name includes docusign
and (
  regex.icontains(strings.replace_confusables(subject.subject),
                  '\bdocu\s*sign\b'
  )
  or regex.icontains(strings.replace_confusables(sender.display_name),
                     '\bdocu\s*sign\b'
  )
)

// there is one unique cloudhq link in the message
and length(distinct(filter(body.links,
                           .href_url.domain.root_domain == "cloudhq.net"
                    ),
                    .href_url.url
           )
) <= 1