[SALESFORCE] Suspicious IP Detected via Bluedot - Successful Login

alert any $HOME_NET any -> $HOME_NET any (msg:"[SALESFORCE] Suspicious IP Detected via Bluedot - Successful Login"; program:salesforce_streaming_api_data; json_content:".channel","/event/LoginEventStream"; json_content:".data.payload.Status","Success"; json_nocase; json_map:"src_ip",".data.payload.SourceIp"; bluedot:type ip_reputation,track by_src,mdate_effective_period 1 months,Malicious,Tor,Proxy; classtype:system-event; reference:url,https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_objects_monitoring.htm; sid:5014032; rev:1;)