[CISCO-IOS] IOS configuration changed

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-IOS] IOS configuration changed"; content: "SYS-5-CONFIG"; content: !"by snmp"; content: !"By SNMP"; content: !"from memory by console"; content: !"Configured from console by console"; content: !"Configured from console by vty"; content: !"from console as vty"; content: !"from console as console"; content:!"entered configuration session"; content:!"exited configuration session"; parse_src_ip: 1; json_map: "dest_ip", ".xff"; threshold: type suppress, track by_src&by_dst, count 1, seconds 21600; classtype: configuration-change; sid:5000111; rev:10; metadata: updated_on 2026_08_06;)