ET INFO McAfee AV Download (set)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET INFO McAfee AV Download (set)";
    flow:established,to_server;
    flowbits:set,ET.Mcafee.Site.Download;
    flowbits:noalert;
    http.method;
    content:"GET";
    http.user_agent;
    content:"McAfee ePO"; fast_pattern;
    http.host;
    content:"update.nai.com";
    classtype:not-suspicious;
    sid:2031317; rev:1;
    metadata:created_at 2020_12_11, performance_impact Low, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_12_11;
)