[MIMECAST] Attachment Sent From Malicious IP

alert any $HOME_NET any -> $HOME_NET any (msg:"[MIMECAST] Attachment Sent From Malicious IP"; program:mimecast; json_content:".eventType","attachment protection"; bluedot:type ip_reputation, track by_src,none,Malicious; json_map:"src_ip",".senderIp"; reference:url,https://developer.services.mimecast.com/siem-tutorial-cg; classtype:suspicious-activity; sid:5017380; rev:1; metadata:created_at 2026_01_16, updated_at 2026_01_16;)