alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Netskope SASE 🌐 for Windows 🪟"; flow:to_server, stateless; threshold:type limit, track by_src,count 1, seconds 3600; ssl_version:tls1.3; ja3.hash; content:"2ad2a395195f7423c6eac3d9bc9042b2"; tls_sni; content:"gateway"; startswith; content:".goskope.com"; endswith; fast_pattern; reference:url,https://www.tanium.fr/; metadata:created_at 2025_07_17, updated_at 2025_07_17; sid:3321453; rev:1; classtype:misc-activity;)