(Workload:ThreatIntelligence Operation:TIMailData Directionality:Inbound) (-DeliveryAction:Blocked)