[MCAS] Possible Unknown MCAS Alert

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[MCAS] Possible Unknown MCAS Alert"; program: MCAS; json_meta_content:! ".Operation",MCAS_ALERT_ANUBIS_DETECTION_NEW_COUNTRY,MCAS_ALERT_ANUBIS_DETECTION_REPEATED_ACTIVITY_DELETE,MCAS_ALERT_ANUBIS_DETECTION_REPEATED_ACTIVITY_FAILED_LOGIN,MCAS_ALERT_ANUBIS_DETECTION_RISKY_IP_ANONYMOUS,MCAS_ALERT_ANUBIS_DETECTION_VELOCITY,MCAS_ALERT_ANUBIS_DETECTION_INBOX_HIDING,MCAS_ALERT_ANUBIS_DETECTION_REPEATED_ACTIVITY_DOWNLOAD,MCAS_ALERT_ANUBIS_DETECTION_REPEATED_ACTIVITY_ADMIN_ACTIVITY; json_contains: ".Operation", "MCAS_ALERT"; classtype: bad-unknown; sid: 5007209; rev: 4; metadata: mitre_technique_id T????;)