From 3e2c2bcb80ca7f3b491cc04d130c15a9366cc0ad Mon Sep 17 00:00:00 2001
From: Sam Scholten <morriscode@gmail.com>
Date: Fri, 29 Sep 2023 09:49:55 -0400
Subject: [PATCH] QR code insight

---
 insights/attachments/links_qr_code.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 insights/attachments/links_qr_code.yml

diff --git a/insights/attachments/links_qr_code.yml b/insights/attachments/links_qr_code.yml
new file mode 100644
index 00000000000..b7be81bb5a4
--- /dev/null
+++ b/insights/attachments/links_qr_code.yml
@@ -0,0 +1,12 @@
+name: "QR code embedded Links in attachments"
+type: "query"
+source: |
+  map(filter(attachments, .file_type ...),
+    map(filter(file.explode(.),
+               .scan.qr.type == "url"
+        ),
+        .scan.qr.url.url
+    )
+  )
+
+severity: "medium"