[FORTINET] Compromised Host Detected

alert any $HOME_NET any -> $HOME_NET any (msg:"[FORTINET] Compromised Host Detected"; content:"trigger=Default-Compromised Host-Detection-IOC-By-"; content:!"type=
| 22
| traffic
| 22
| "; meta_content:!" level=
| 22
| %sagan%
| 22
| ",warning,notice; reference:url,https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/ef4bde1e-412e-11ee-8e6d-fa163e15d75b/FortiAnalyzer-7.4.1-Administration_Guide.pdf; parse_src_ip:1; content:!"- - - -"; classtype:trojan-activity; sid:5014360; rev:1;)