Office365 detect

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "Office365 detect"; metadata: fingerprint_source logs, fingerprint_type server, fingerprint_expire 86400; threshold: type limit, track by_src, seconds 3600, count 1; meta_content: "%sagan%",ALERT_ANUBIS_DETECTION_VELOCITY,ALERT_CABINET_EVENT_MATCH_AUDIT,ALERT_ANUBIS_DETECTION_NEW_COUNTRY,ALERT_DISCOVERY_ANOMALY_DETECTION,ALERT_CABINET_EVENT_MATCH_FILE,ALERT_CABINET_INLINE_EVENT_MATCH,ALERT_CABINET_EVENT_MATCH_OBJECT,ALERT_CABINET_DISCOVERY_NEW_SERVICE,ALERT_PERSONAL_USER_SAGE,ALERT_GEOLOCATION_NEW_COUNTRY,ALERT_ADMIN_USER,ALERT_ZOMBIE_USER,ALERT_NEW_ADMIN_LOCATION,ALERT_COMPROMISED_ACCOUNT,EVENT_CATEGORY_LOGOUT,EVENT_CATEGORY_LOGIN,EVENT_CATEGORY_CREATE_USER,EVENT_CATEGORY_DELETE_USER,ALERT_ANUBIS_DETECTION_REPEATED_ACTIVIY,ALERT_ANUBIS_DETECTION_REPEATED_ACTIVITY_ADMIN_ACTIVITY,ALERT_MANAGEMENT_DISCOVERY_BREACHED_APP; classtype: fingerprint; sid:5100113; rev:1;)