alert ip any any -> any any (msg:        "SURICATA Applatocol both direction"; flow:established; app-layer-event:                                                        vent:                                                                                                            t:.com"; _4;)