alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DOS LOIC GET"; flow:established,to_server; threshold:type limit, track by_src, count 1, seconds 300; http.method; content:"GET"; http.uri; content:"/?msg=MSG"; classtype:web-application-attack; sid:2016031; rev:4; metadata:created_at 2012_12_14, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_05_06;)