TP: If you're able to confirm that inbox rule was designed by an OAuth third-bash app with suspicious scopes sent from an not known supply, then a true constructive is indicated.FP: If you’re in a position to confirm that LOB app accessed from abnormal place for respectable purpose and no unconventional routines done.If you'd like to develop a me