[Test Rules] [PR #4317] modified rule: Body: Fake conversation with spouse mention and video call request

Author: github-actions[bot]

detection-rules/4317_body_spouse_fake_call.yml

@@ -5,49 +5,17 @@ severity: "medium"
 source: |
   type.inbound
   and length(body.previous_threads) >= 3
-  and (
-    (
-      (
-        strings.icontains(body.previous_threads[length(body.previous_threads) - 2].text,
-                          "wife and i"
-        )
-        or strings.icontains(body.previous_threads[length(body.previous_threads) - 2].text,
-                             "husband and i"
-        )
-      )
-      and strings.icontains(body.previous_threads[length(body.previous_threads) - 2].text,
-                            "call"
-      )
-      and (
-        strings.icontains(body.previous_threads[length(body.previous_threads) - 2].text,
-                          "zoom"
-        )
-        or strings.icontains(body.previous_threads[length(body.previous_threads) - 2].text,
-                             "google meet"
-        )
-      )
-    )
-    or (
-      (
-        strings.icontains(body.previous_threads[length(body.previous_threads) - 3].text,
-                          "wife and i"
-        )
-        or strings.icontains(body.previous_threads[length(body.previous_threads) - 3].text,
-                             "husband and i"
-        )
-      )
-      and strings.icontains(body.previous_threads[length(body.previous_threads) - 3].text,
-                            "call"
-      )
-      and (
-        strings.icontains(body.previous_threads[length(body.previous_threads) - 3].text,
-                          "zoom"
-        )
-        or strings.icontains(body.previous_threads[length(body.previous_threads) - 3].text,
-                             "google meet"
-        )
-      )
-    )
+  and any(body.previous_threads,
+          strings.icontains(.text, "call")
+          and (
+            strings.icontains(.text, "wife and i")
+            or strings.icontains(.text, "husband and i")
+          )
+          and (
+            (strings.icontains(.text, "zoom"))
+            or (strings.icontains(.text, "google meet"))
+          )
+          and length(.text) < 1400
   )
 
 attack_types:
@@ -60,4 +28,4 @@ detection_methods:
 id: "5b7a2e34-fda0-5aa7-ac6a-2bdd2c91dc05"
 og_id: "bd23f3b2-a1e5-5a7c-ab0c-c15d4c4458f5"
 testing_pr: 4317
-testing_sha: dccd3dd546dd29fdfef00327f9ac88100df1b887
+testing_sha: 5f37e408d1dfe0e2dc6cee3c98e63d7596725942