A rule that detects spam verdicts produced by the ml.attack_score_flash() function on inbound traffic. The rule triggers when type.inbound is true and ml.attack_score_flash().verdict == "spam". It is categorized under Attack Surface Reduction with medium severity. It is designed to flag inbound communications that are classified as spam by the ML scoring component, enabling downstream blocking or alerting.