alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY CNET TechTracker Software Manager request"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/rest/"; content:"Report?"; fast_pattern; content:"Id="; http.header_names; content:!"User-Agent|0d 0a|"; content:!"Referer|0d 0a|"; reference:url,www.cnet.com/techtracker-free/; classtype:policy-violation; sid:2013454; rev:4; metadata:created_at 2011_08_24, confidence High, signature_severity Informational, updated_at 2020_04_22;)