I am testing to create a rule to detect when an email is sent to a large number of recipients. As there is no such capability in the rules, I have made the following, a rule that detects SMTP protocol AND a regex to detect mails \b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}\b ...