alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY TuneIn Internet Radio Usage Detected"; flow:established,to_server; http.uri; content:"/tuner/?StationId="; fast_pattern; http.header; content:"tunein.com|0d 0a|"; reference:url,tunein.com/support/get-started; classtype:policy-violation; sid:2015485; rev:4; metadata:created_at 2012_07_18, confidence High, signature_severity Informational, updated_at 2020_09_17;)