alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY Possible IP Check api.ipify.org"; flow:established,from_server; tls.cert_subject; content:"CN=api.ipify.org"; classtype:policy-violation; sid:2019512; rev:4; metadata:created_at 2014_10_27, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_20;)