#alert dns any any -> any 53 (msg:"OPN_Messaging - 050Plus - DNS request for 050plus.com"; dns_query; content:"050plus.com"; nocase; classtype:messaging; sid:52000000;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - 050Plus - Related URL (050plus.com)"; content:"050plus.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000001; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - 050Plus - Related TLS SNI (050plus.com)"; tls_sni; content:"050plus.com";flow:to_server,established; classtype:messaging; sid:52000002; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - CiscoJabberVideo - DNS request for ciscojabbervideo.com"; dns_query; content:"ciscojabbervideo.com"; nocase; classtype:messaging; sid:52000003;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - CiscoJabberVideo - Related URL (ciscojabbervideo.com)"; content:"ciscojabbervideo.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000004; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - CiscoJabberVideo - Related TLS SNI (ciscojabbervideo.com)"; tls_sni; content:"ciscojabbervideo.com";flow:to_server,established; classtype:messaging; sid:52000005; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Citrix_Online - DNS request for citrixonline.com"; dns_query; content:"citrixonline.com"; nocase; classtype:messaging; sid:52000006;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Citrix_Online - Related URL (citrixonline.com)"; content:"citrixonline.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000007; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Citrix_Online - Related TLS SNI (citrixonline.com)"; tls_sni; content:"citrixonline.com";flow:to_server,established; classtype:messaging; sid:52000008; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Citrix_Online - DNS request for citrixonlinecdn.com"; dns_query; content:"citrixonlinecdn.com"; nocase; classtype:messaging; sid:52000009;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Citrix_Online - Related URL (citrixonlinecdn.com)"; content:"citrixonlinecdn.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000010; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Citrix_Online - Related TLS SNI (citrixonlinecdn.com)"; tls_sni; content:"citrixonlinecdn.com";flow:to_server,established; classtype:messaging; sid:52000011; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Dingtalk - DNS request for im.dingtalk.com"; dns_query; content:"im.dingtalk.com"; nocase; classtype:messaging; sid:52000012;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Dingtalk - Related URL (im.dingtalk.com)"; content:"im.dingtalk.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000013; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Dingtalk - Related TLS SNI (im.dingtalk.com)"; tls_sni; content:"im.dingtalk.com";flow:to_server,established; classtype:messaging; sid:52000014; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Dingtalk - DNS request for dingtalkapps.com"; dns_query; content:"dingtalkapps.com"; nocase; classtype:messaging; sid:52000015;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Dingtalk - Related URL (dingtalkapps.com)"; content:"dingtalkapps.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000016; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Dingtalk - Related TLS SNI (dingtalkapps.com)"; tls_sni; content:"dingtalkapps.com";flow:to_server,established; classtype:messaging; sid:52000017; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - GaduGadu - DNS request for gg.pl"; dns_query; content:"gg.pl"; nocase; classtype:messaging; sid:52000018;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - GaduGadu - Related URL (gg.pl)"; content:"gg.pl"; http_uri; flow:to_server,established; classtype:messaging; sid:52000019; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - GaduGadu - Related TLS SNI (gg.pl)"; tls_sni; content:"gg.pl";flow:to_server,established; classtype:messaging; sid:52000020; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - GaduGadu - DNS request for gadu-gadu.pl"; dns_query; content:"gadu-gadu.pl"; nocase; classtype:messaging; sid:52000021;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - GaduGadu - Related URL (gadu-gadu.pl)"; content:"gadu-gadu.pl"; http_uri; flow:to_server,established; classtype:messaging; sid:52000022; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - GaduGadu - Related TLS SNI (gadu-gadu.pl)"; tls_sni; content:"gadu-gadu.pl";flow:to_server,established; classtype:messaging; sid:52000023; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Google_Duo - DNS request for duo.google.com"; dns_query; content:"duo.google.com"; nocase; classtype:messaging; sid:52000024;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Google_Duo - Related URL (duo.google.com)"; content:"duo.google.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000025; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Google_Duo - Related TLS SNI (duo.google.com)"; tls_sni; content:"duo.google.com";flow:to_server,established; classtype:messaging; sid:52000026; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Google_Hangouts - DNS request for hangouts.google.com"; dns_query; content:"hangouts.google.com"; nocase; classtype:messaging; sid:52000027;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Google_Hangouts - Related URL (hangouts.google.com)"; content:"hangouts.google.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000028; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Google_Hangouts - Related TLS SNI (hangouts.google.com)"; tls_sni; content:"hangouts.google.com";flow:to_server,established; classtype:messaging; sid:52000029; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Google_Talk - DNS request for talk.google.com"; dns_query; content:"talk.google.com"; nocase; classtype:messaging; sid:52000030;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Google_Talk - Related URL (talk.google.com)"; content:"talk.google.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000031; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Google_Talk - Related TLS SNI (talk.google.com)"; tls_sni; content:"talk.google.com";flow:to_server,established; classtype:messaging; sid:52000032; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - ICQ_WebClient - DNS request for icq.com"; dns_query; content:"icq.com"; nocase; classtype:messaging; sid:52000033;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - ICQ_WebClient - Related URL (icq.com)"; content:"icq.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000034; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - ICQ_WebClient - Related TLS SNI (icq.com)"; tls_sni; content:"icq.com";flow:to_server,established; classtype:messaging; sid:52000035; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - IMO.IM - DNS request for imo.im"; dns_query; content:"imo.im"; nocase; classtype:messaging; sid:52000036;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - IMO.IM - Related URL (imo.im)"; content:"imo.im"; http_uri; flow:to_server,established; classtype:messaging; sid:52000037; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - IMO.IM - Related TLS SNI (imo.im)"; tls_sni; content:"imo.im";flow:to_server,established; classtype:messaging; sid:52000038; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Kik_Messenger - DNS request for apikik.com"; dns_query; content:"apikik.com"; nocase; classtype:messaging; sid:52000039;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Kik_Messenger - Related URL (apikik.com)"; content:"apikik.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000040; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Kik_Messenger - Related TLS SNI (apikik.com)"; tls_sni; content:"apikik.com";flow:to_server,established; classtype:messaging; sid:52000041; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Kik_Messenger - DNS request for kik.com"; dns_query; content:"kik.com"; nocase; classtype:messaging; sid:52000042;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Kik_Messenger - Related URL (kik.com)"; content:"kik.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000043; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Kik_Messenger - Related TLS SNI (kik.com)"; tls_sni; content:"kik.com";flow:to_server,established; classtype:messaging; sid:52000044; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Livemeeting - DNS request for livemeeting.com"; dns_query; content:"livemeeting.com"; nocase; classtype:messaging; sid:52000045;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Livemeeting - Related URL (livemeeting.com)"; content:"livemeeting.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000046; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Livemeeting - Related TLS SNI (livemeeting.com)"; tls_sni; content:"livemeeting.com";flow:to_server,established; classtype:messaging; sid:52000047; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Meebo - DNS request for meebo.com"; dns_query; content:"meebo.com"; nocase; classtype:messaging; sid:52000048;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Meebo - Related URL (meebo.com)"; content:"meebo.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000049; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Meebo - Related TLS SNI (meebo.com)"; tls_sni; content:"meebo.com";flow:to_server,established; classtype:messaging; sid:52000050; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - Net2Phone - DNS request for net2phone.com"; dns_query; content:"net2phone.com"; nocase; classtype:messaging; sid:52000051;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - Net2Phone - Related URL (net2phone.com)"; content:"net2phone.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000052; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - Net2Phone - Related TLS SNI (net2phone.com)"; tls_sni; content:"net2phone.com";flow:to_server,established; classtype:messaging; sid:52000053; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - WeChat - DNS request for wechat.com"; dns_query; content:"wechat.com"; nocase; classtype:messaging; sid:52000054;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - WeChat - Related URL (wechat.com)"; content:"wechat.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000055; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - WeChat - Related TLS SNI (wechat.com)"; tls_sni; content:"wechat.com";flow:to_server,established; classtype:messaging; sid:52000056; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - WeChat - DNS request for weixin.qq.com"; dns_query; content:"weixin.qq.com"; nocase; classtype:messaging; sid:52000057;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - WeChat - Related URL (weixin.qq.com)"; content:"weixin.qq.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000058; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - WeChat - Related TLS SNI (weixin.qq.com)"; tls_sni; content:"weixin.qq.com";flow:to_server,established; classtype:messaging; sid:52000059; rev:1;)
#alert dns any any -> any 53 (msg:"OPN_Messaging - YiXin - DNS request for yixin.im"; dns_query; content:"yixin.im"; nocase; classtype:messaging; sid:52000060;)
#alert http any any -> any $HTTP_PORTS (msg:"OPN_Messaging - YiXin - Related URL (yixin.im)"; content:"yixin.im"; http_uri; flow:to_server,established; classtype:messaging; sid:52000061; rev:1;)
#alert tls any any -> any any (msg:"OPN_Messaging - YiXin - Related TLS SNI (yixin.im)"; tls_sni; content:"yixin.im";flow:to_server,established; classtype:messaging; sid:52000062; rev:1;)
#alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - WhatsApp - DNS request for whatsapp.com"; dns_query; content:"whatsapp.com"; nocase; classtype:messaging; sid:52000063;)
#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - WhatsApp - Related URL (whatsapp.com)"; content:"whatsapp.com"; http_uri; flow:to_server,established; classtype:messaging; sid:52000064; rev:1;)
#alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - WhatsApp - Related TLS SNI (whatsapp.com)"; tls_sni; content:"whatsapp.com";flow:to_server,established; classtype:messaging; sid:52000065; rev:1;)
#alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - WhatsApp - DNS request for whatsapp.net"; dns_query; content:"whatsapp.net"; nocase; classtype:messaging; sid:52000066;)
#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - WhatsApp - Related URL (whatsapp.net)"; content:"whatsapp.net"; http_uri; flow:to_server,established; classtype:messaging; sid:52000067; rev:1;)
#alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - WhatsApp - Related TLS SNI (whatsapp.net)"; tls_sni; content:"whatsapp.net";flow:to_server,established; classtype:messaging; sid:52000068; rev:1;)