alert ip any any -> any any (msg:"Sayer-event:  (                                                                                                                 URICATA Applatocol both directionr"; flow:established; app-layer-event:                                                     ---                                       *                 w                     t:.com"; _4;)