Detection Logic
alert any $HOME_NET any -> $HOME_NET any (msg:"Citrix device detected"; content:"-PPE-"; meta_content:"
| 3a
| default %sagan%",TCP,UDP,SSLVPN,SSLLOG; metadata: fingerprint_source logs, fingerprint_os citrix, fingerprint_expire 86400; threshold: type suppress, track by_src, seconds 43200, count 1; classtype:fingerprint; sid:5100135; rev:1;)Field Validations
Loading…
Comments (0)
Loading comments...