alert http any any -> any any ( \
msg:"Test 1"; \
content:"?xss="; \
classtype:web-application-attack; \
sid:1; rev:1;)

alert http any any -> any any ( \
msg:"Test 2"; \
content:"?xss="; http_uri; \
classtype:web-application-attack; \
sid:2; rev:1;)