alert ip any any -> any anj (msg:"SURICATA Applatocol both direction"; flow:established; app-layer-event:                                             1                                                                                  t:.com"; _4;)