[MIMECAST] Impersonation Protection Tagged Malicious By Threat Dictionary

alert any $HOME_NET any -> $HOME_NET any (msg:"[MIMECAST] Impersonation Protection Tagged Malicious By Threat Dictionary"; program:mimecast; json_content:".eventType","impersonation protection"; json_content:".action","Acc"; json_content:".mimecastThreatDictionary","true"; reference:url,https://developer.services.mimecast.com/siem-tutorial-cg; classtype:suspicious-activity; sid:5017371; rev:1; metadata:created_at 2026_01_16, updated_at 2026_01_16;)