[MIMECAST] Impersonation Protection Tagged Malicious By Similar External Domain

alert any $HOME_NET any -> $HOME_NET any (msg:"[MIMECAST] Impersonation Protection Tagged Malicious By Similar External Domain"; program:mimecast; json_content:".eventType","impersonation protection"; json_content:".action","Acc"; json_content:".similarMimecastExternalDomain","true"; reference:url,https://developer.services.mimecast.com/siem-tutorial-cg; classtype:suspicious-activity; sid:5017373; rev:1; metadata:created_at 2026_01_16, updated_at 2026_01_16;)