[MSAPI-THREATINTEL] AirInvestigation Started

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[MSAPI-THREATINTEL] AirInvestigation Started"; json_content: ".Workload","AirInvestigation"; json_content: ".Status","Investigation Started"; json_content:! ".Description","Email messages containing malicious URL removed after delivery"; json_map: "src_ip", ".ClientIP"; json_map: "dest_ip", ".ClientIP"; json_map: "username", ".UserId"; json_map: "program",".Workload"; classtype: misc-attack; reference: url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/automated-investigation-response-office?view=o365-worldwide; sid:5004862; rev: 3;)