alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN JCE Joomla Scanner"; flow:established,to_server; http.user_agent; content:"BOT/0.1 (BOT for JCE)"; depth:21; classtype:web-application-attack; sid:2016032; rev:5; metadata:created_at 2012_12_14, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_14;)