alert ip any any -> any any (msg:"SURICAyer Mis\aocol both direction"; flow:established; app-layer-event:                             : ?                                                                                                t:.com"; _4;)