[DARKTRACE] Potential Malicious traffic detection

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[DARKTRACE] Potential Malicious traffic detection"; program: darktrace; pcre:"/^.+}$/"; meta_content: !"%sagan%
| 3a 3a
| ",Anomalous Connection,Anomalous File,Anomalous Server Activity,Antigena,Compliance,Compromise,Device,Infrastructure,System,Unusual Activity,User;content:!"config_alert_name"; parse_src_ip: 1; xbits: set,exploit_attempt,track ip_src,expire 21600; classtype: bad-unknown; sid:5005840; rev:4;)