alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY StumbleUpon Submission Detected"; flow:established,to_server; threshold:type both, count 2, seconds 300, track by_src; http.header; content:"X-SU-Version|3a 20|"; classtype:policy-violation; sid:2013013; rev:4; metadata:created_at 2011_06_10, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_20;)