alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO CNET TechTracker Software Manager request"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/rest/"; content:"Report?"; fast_pattern; content:"Id="; http.header_names; to_lowercase; content:!"|0d 0a|user-agent|0d 0a|"; content:!"|0d 0a|referer|0d 0a|"; reference:url,www.cnet.com/techtracker-free/; classtype:policy-violation; sid:2013454; rev:5; metadata:created_at 2011_08_24, confidence High, signature_severity Informational, updated_at 2024_04_20;)