alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ FortiClient VPN 🧱"; flow:to_client, stateless; threshold:type limit, track by_src,count 1, seconds 86400; ssl_version:tls1.2; tls.cert_subject; content:"CN=globalupdate.fortinet.net"; nocase; fast_pattern; content:"|4f 3d 46 6f 72 74 69 6e 65 74 2c 20 49 6e 63 2e|"; content:"L=Sunnyvale"; nocase; content:"ST=California"; nocase; content:" C=US"; nocase; reference:url,https://www.fortinet.com/support/product-downloads; metadata:created_at 2023_03_12 updated_at 2023_03_12; sid:3300764; rev:1; classtype:misc-activity;)