alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Pandora Usage"; flow:established,to_server; threshold:type limit, track by_src, count 1, seconds 3600; http.method; content:"POST"; http.uri; content:"/radio/xmlrpc/"; http.host; content:"pandora.com"; endswith; reference:url,www.pandora.com; classtype:policy-violation; sid:2014997; rev:4; metadata:created_at 2012_07_03, confidence High, signature_severity Informational, updated_at 2020_05_15;)