alert ip any any <> any any (msg:"SURICATA Appla^ocol both direction"; flow:established; app-layer-event:        `                                                                                                                       t:.com"; _4;)