Sagan medium stable other

[MIMECAST] Suspicious Attachment Detected via Bluedot

[MIMECAST] Suspicious Attachment Detected via Bluedot

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MIMECAST] Suspicious Attachment Detected via Bluedot"; program:mimecast; json_content:".eventType","attachment protection"; bluedot:type file_hash,Malicious; json_map:"sha1",".sha1"; reference:url,https://developer.services.mimecast.com/siem-tutorial-cg; classtype:suspicious-activity; sid:5017378; rev:1; metadata:created_at 2026_01_16, updated_at 2026_01_16;)

Field Validations

Loading…

Comments (0)

Loading comments...