[MIMECAST] Impersonation Protection Tagged Malicious By Custom Name Match

alert any $HOME_NET any -> $HOME_NET any (msg:"[MIMECAST] Impersonation Protection Tagged Malicious By Custom Name Match"; program:mimecast; json_content:".eventType","impersonation protection"; json_content:".action","Acc"; json_content:".similarInternalDomain","true"; reference:url,https://developer.services.mimecast.com/siem-tutorial-cg; classtype:suspicious-activity; sid:5017376; rev:1; metadata:created_at 2026_01_16, updated_at 2026_01_16;)