Rule History

alert http any any -> any any (msg: "SUSPICIOUS [PTsecurity] Suspicious User-Agent (go-external-ip)"; flow: established, to_server; http.user_agent; content: "go-external-ip (github.com/glendc/go-external-ip)"; threshold: type limit, track by_src, count 1, seconds 600; reference: url, https://app.any.run/tasks/3a15dd52-5bb9-4e35-9b80-dcd29099b157; reference: url, rules.ptsecurity.com; classtype: misc-activity; sid: 10011380; rev: 2;)