✄𐘗
text code block:
✄𐘗(
  data_stream.dataset:suricata.eve and
  suricata.eve.event_type:mqtt and
  network.protocol:mqtt or
  data_stream.dataset:zeek.connection and
  network.protocol:mqtt or
  data_stream.dataset:panw.panos and
  network.application:mqtt-base or
  data_stream.dataset:network_traffic.tls and
  tls.established:true and
  tls.client.server_name:* and
  (
    destination.port:443 and
    tls.detailed.client_hello.extensions.application_layer_protocol_negotiation:"x-amzn-mqtt-ca" or
    destination.port:8883 and
    tls.client.server_name:(
      *-ats.iot.*.amazonaws.com or
      *-ats.iot.*.amazonaws.com. or
      *-ats.iot.*.amazonaws.com.cn or
      *-ats.iot.*.amazonaws.com.cn.
    )
  )
) and
  network.transport:tcp and
  source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or "FC00::/7") and
  destination.ip:(
    * and not (
      10.0.0.0/8 or 100.64.0.0/10 or 127.0.0.0/8 or 169.254.0.0/16 or 172.16.0.0/12 or
      192.0.0.0/24 or 192.0.0.0/29 or 192.0.0.10/32 or 192.0.0.170/32 or 192.0.0.171/32 or
      192.0.0.8/32 or 192.0.0.9/32 or 192.0.2.0/24 or 192.168.0.0/16 or 192.175.48.0/24 or
      192.31.196.0/24 or 192.52.193.0/24 or 192.88.99.0/24 or 198.18.0.0/15 or
      198.51.100.0/24 or 203.0.113.0/24 or 224.0.0.0/4 or 240.0.0.0/4 or "::1" or
      "FC00::/7" or "FE80::/10" or "FF00::/8"
    )
  ) and
  not (
    data_stream.dataset:panw.panos and (
      event.action:(flow_denied or flow_dropped) or
      network.application:(incomplete or insufficient-data or not-applicable)
    )
  )