alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Go-http-client User-Agent Observed Inbound"; flow:established,to_server; http.user_agent; content:"Go-http-client/"; nocase; fast_pattern; startswith; threshold:type limit, seconds 180, count 1, track by_src; reference:url,go.dev/src/net/http/request.go#L545; classtype:misc-activity; sid:2060252; rev:1; metadata:affected_product Any, attack_target Client_and_Server, tls_state plaintext, created_at 2025_02_21, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, updated_at 2025_02_21;)