Suricata

Consider 2 rules:

file.data; content:"abc"; flowbit:set,bit1;
http.uri; content:"xyz"; flowbit:isset,bit1;

The first rule will be evaluated last because it is part of the response. We should warn here.

Consider 2 rules:

http.request_body; content:"abc"; flowbit:set,bit1;
http.uri; content:"xyz"; flowbit:isset,bit1;

The first rule will be evaluated last because it happens later in the stream. We should warn here. We can look at the max "progress value" associated with a buffer perhaps.