[SOPHOS_FIREWALL] Anti-Spam Module Detection

alert any $HOME_NET any -> $HOME_NET any (msg:"[SOPHOS_FIREWALL] Anti-Spam Module Detection"; program:sophos; content:"log_type=
| 22
| Event
| 22
| "; content:"log_type=
| 22
| Anti-Spam
| 22
| "; meta_content:!"log_subtype=
| 22
| %sagan%
| 22
| ",Clean,Allowed,Denied; parse_src_ip:1; normalize; reference:url,https://docs.sophos.com/nsg/sophos-firewall/21.5/pdf/sf-syslog-guide-21.5.pdf; classtype:trojan-activity; sid:5017434; rev:1;)