From c36eb970d36682850470b25d9e104706d2bb5408 Mon Sep 17 00:00:00 2001
From: Aiden Mitchell <me@aidenmitchell.ca>
Date: Tue, 19 Nov 2024 09:00:17 -0800
Subject: [PATCH] Create icloud_private_relay.yml (#2129)

---
 insights/sender/icloud_private_relay.yml | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 insights/sender/icloud_private_relay.yml

diff --git a/insights/sender/icloud_private_relay.yml b/insights/sender/icloud_private_relay.yml
new file mode 100644
index 00000000000..9f3d045ccde
--- /dev/null
+++ b/insights/sender/icloud_private_relay.yml
@@ -0,0 +1,5 @@
+name: "Routed through Apple iCloud Private Email relay"
+type: "query"
+source: |
+  regex.icontains(sender.email.email, '_at_.*@icloud.com')
+severity: "informational"