alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Apple iDisk Sync Unencrypted"; flow:established,to_server; http.header; content:"|0d 0a|Host|3a 20|idisk.mac.com|0d 0a|"; nocase; http.user_agent; content:"DotMacKit-like, File-Sync-Direct"; depth:32; nocase; classtype:policy-violation; sid:2012331; rev:6; metadata:created_at 2011_02_22, confidence High, signature_severity Informational, updated_at 2020_10_19;)