This rule exercises a machine learning function, ml.attack_score_flash(), to evaluate inbound events. It triggers when the function's verdict is malicious or potentially_malicious. The rule is intended to validate the ML scoring path and surface inbound activity flagged by the attack score for further investigation or automated response. It does not rely on a specific indicator other than the ML verdict, and its medium severity suggests its use for calibration, testing, or staging ML-driven detections rather than enforcing a closing block of traffic. The rule's configuration references the inbound context and calls the flash variant of the attack score, indicating a quick risk assessment rather than a comprehensive anomaly profile. In deployment, alerts generated by this rule should be correlated with other indicators to reduce false positives and to confirm the ML score's reliability.