Feb  1 10:01:30 fw1 logger: run_oinkmaster.pl:         alert tcp _HOME_NET any ->
_EXTERNAL_NET 6666:7000 (msg:"CHAT IRC channel notice"_ flow:to_server,established_
content:"NOTICE "_ nocase_ pcre:"/^_s*NOTICE/smi"_ classtype:policy-violation_
sid:6182_ rev:1_)