alert http $HOME_NET any -> $EXTERNAL_NET 80 (msg:"🐾 - ℹ Veeam Backup and Replication"; flow:to_server, stateless; threshold:type limit, track by_src,count 1, seconds 86400; http.method; content:"GET"; http.host.raw; content:"dev.veeam.com"; endswith; fast_pattern; http.uri; content:"/backup/vbrupdate-ce.vdf"; reference:url,https://www.veeam.com/products/veeam-data-platform/backup-recovery.html; metadata:created_at 2024_07_19, updated_at 2024_07_19; sid:3321297; rev:1; classtype:misc-activity;)