alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - 050Plus - DNS request for 050plus.com"; dns.query; content:"050plus.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - 050Plus - Related URL (050plus.com)"; http.uri; content:"050plus.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000001; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - 050Plus - Related TLS SNI (050plus.com)"; tls.sni; content:"050plus.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000002; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Dingtalk - DNS request for im.dingtalk.com"; dns.query; content:"im.dingtalk.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Dingtalk - Related URL (im.dingtalk.com)"; http.uri; content:"im.dingtalk.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000004; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Dingtalk - Related TLS SNI (im.dingtalk.com)"; tls.sni; content:"im.dingtalk.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000005; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Dingtalk - DNS request for dingtalkapps.com"; dns.query; content:"dingtalkapps.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Dingtalk - Related URL (dingtalkapps.com)"; http.uri; content:"dingtalkapps.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000007; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Dingtalk - Related TLS SNI (dingtalkapps.com)"; tls.sni; content:"dingtalkapps.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000008; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - GaduGadu - DNS request for gg.pl"; dns.query; content:"gg.pl"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - GaduGadu - Related URL (gg.pl)"; http.uri; content:"gg.pl"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000010; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - GaduGadu - Related TLS SNI (gg.pl)"; tls.sni; content:"gg.pl"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000011; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - GaduGadu - DNS request for gadu-gadu.pl"; dns.query; content:"gadu-gadu.pl"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - GaduGadu - Related URL (gadu-gadu.pl)"; http.uri; content:"gadu-gadu.pl"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000013; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - GaduGadu - Related TLS SNI (gadu-gadu.pl)"; tls.sni; content:"gadu-gadu.pl"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000014; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - IMO.IM - DNS request for imo.im"; dns.query; content:"imo.im"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - IMO.IM - Related URL (imo.im)"; http.uri; content:"imo.im"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000016; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - IMO.IM - Related TLS SNI (imo.im)"; tls.sni; content:"imo.im"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000017; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Kik_Messenger - DNS request for apikik.com"; dns.query; content:"apikik.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Kik_Messenger - Related URL (apikik.com)"; http.uri; content:"apikik.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000019; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Kik_Messenger - Related TLS SNI (apikik.com)"; tls.sni; content:"apikik.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000020; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Kik_Messenger - DNS request for kik.com"; dns.query; content:"kik.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Kik_Messenger - Related URL (kik.com)"; http.uri; content:"kik.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000022; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Kik_Messenger - Related TLS SNI (kik.com)"; tls.sni; content:"kik.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000023; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Net2Phone - DNS request for net2phone.com"; dns.query; content:"net2phone.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Net2Phone - Related URL (net2phone.com)"; http.uri; content:"net2phone.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000025; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Net2Phone - Related TLS SNI (net2phone.com)"; tls.sni; content:"net2phone.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000026; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - WeChat - DNS request for wechat.com"; dns.query; content:"wechat.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - WeChat - Related URL (wechat.com)"; http.uri; content:"wechat.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000028; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - WeChat - Related TLS SNI (wechat.com)"; tls.sni; content:"wechat.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000029; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - WeChat - DNS request for weixin.qq.com"; dns.query; content:"weixin.qq.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - WeChat - Related URL (weixin.qq.com)"; http.uri; content:"weixin.qq.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000031; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - WeChat - Related TLS SNI (weixin.qq.com)"; tls.sni; content:"weixin.qq.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000032; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - YiXin - DNS request for yixin.im"; dns.query; content:"yixin.im"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - YiXin - Related URL (yixin.im)"; http.uri; content:"yixin.im"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000034; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - YiXin - Related TLS SNI (yixin.im)"; tls.sni; content:"yixin.im"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000035; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - WhatsApp - DNS request for whatsapp.com"; dns.query; content:"whatsapp.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - WhatsApp - Related URL (whatsapp.com)"; http.uri; content:"whatsapp.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000037; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - WhatsApp - Related TLS SNI (whatsapp.com)"; tls.sni; content:"whatsapp.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000038; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - WhatsApp - DNS request for whatsapp.net"; dns.query; content:"whatsapp.net"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - WhatsApp - Related URL (whatsapp.net)"; http.uri; content:"whatsapp.net"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000040; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - WhatsApp - Related TLS SNI (whatsapp.net)"; tls.sni; content:"whatsapp.net"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000041; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Discord - DNS request for discord.com"; dns.query; content:"discord.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Discord - Related URL (discord.com)"; http.uri; content:"discord.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000043; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Discord - Related TLS SNI (discord.com)"; tls.sni; content:"discord.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000044; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Discord - DNS request for discord.gg"; dns.query; content:"discord.gg"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Discord - Related URL (discord.gg)"; http.uri; content:"discord.gg"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000046; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Discord - Related TLS SNI (discord.gg)"; tls.sni; content:"discord.gg"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000047; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Discord - DNS request for discordapp.com"; dns.query; content:"discordapp.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Discord - Related URL (discordapp.com)"; http.uri; content:"discordapp.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000049; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Discord - Related TLS SNI (discordapp.com)"; tls.sni; content:"discordapp.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000050; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Discord - DNS request for discordapp.net"; dns.query; content:"discordapp.net"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Discord - Related URL (discordapp.net)"; http.uri; content:"discordapp.net"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000052; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Discord - Related TLS SNI (discordapp.net)"; tls.sni; content:"discordapp.net"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000053; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Slack - DNS request for slack.com"; dns.query; content:"slack.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Slack - Related URL (slack.com)"; http.uri; content:"slack.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000055; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Slack - Related TLS SNI (slack.com)"; tls.sni; content:"slack.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000056; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Telegram - DNS request for telegram.org"; dns.query; content:"telegram.org"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Telegram - Related URL (telegram.org)"; http.uri; content:"telegram.org"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000058; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Telegram - Related TLS SNI (telegram.org)"; tls.sni; content:"telegram.org"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000059; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Telegram - DNS request for telegram.me"; dns.query; content:"telegram.me"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Telegram - Related URL (telegram.me)"; http.uri; content:"telegram.me"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000061; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Telegram - Related TLS SNI (telegram.me)"; tls.sni; content:"telegram.me"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000062; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Telegram - DNS request for t.me"; dns.query; content:"t.me"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Telegram - Related URL (t.me)"; http.uri; content:"t.me"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000064; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Telegram - Related TLS SNI (t.me)"; tls.sni; content:"t.me"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000065; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Signal - DNS request for signal.org"; dns.query; content:"signal.org"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Signal - Related URL (signal.org)"; http.uri; content:"signal.org"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000067; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Signal - Related TLS SNI (signal.org)"; tls.sni; content:"signal.org"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000068; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Skype - DNS request for skype.com"; dns.query; content:"skype.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Skype - Related URL (skype.com)"; http.uri; content:"skype.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000070; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Skype - Related TLS SNI (skype.com)"; tls.sni; content:"skype.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000071; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Skype - DNS request for skypeassets.com"; dns.query; content:"skypeassets.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Skype - Related URL (skypeassets.com)"; http.uri; content:"skypeassets.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000073; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Skype - Related TLS SNI (skypeassets.com)"; tls.sni; content:"skypeassets.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000074; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Teams - DNS request for teams.microsoft.com"; dns.query; content:"teams.microsoft.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Teams - Related URL (teams.microsoft.com)"; http.uri; content:"teams.microsoft.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000076; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Teams - Related TLS SNI (teams.microsoft.com)"; tls.sni; content:"teams.microsoft.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000077; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Teams - DNS request for teams.live.com"; dns.query; content:"teams.live.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Teams - Related URL (teams.live.com)"; http.uri; content:"teams.live.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000079; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Teams - Related TLS SNI (teams.live.com)"; tls.sni; content:"teams.live.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000080; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Messenger - DNS request for messenger.com"; dns.query; content:"messenger.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Messenger - Related URL (messenger.com)"; http.uri; content:"messenger.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000082; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Messenger - Related TLS SNI (messenger.com)"; tls.sni; content:"messenger.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000083; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Viber - DNS request for viber.com"; dns.query; content:"viber.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Viber - Related URL (viber.com)"; http.uri; content:"viber.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000085; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Viber - Related TLS SNI (viber.com)"; tls.sni; content:"viber.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000086; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Line - DNS request for line.me"; dns.query; content:"line.me"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Line - Related URL (line.me)"; http.uri; content:"line.me"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000088; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Line - Related TLS SNI (line.me)"; tls.sni; content:"line.me"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000089; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Google_Chat - DNS request for chat.google.com"; dns.query; content:"chat.google.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Google_Chat - Related URL (chat.google.com)"; http.uri; content:"chat.google.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000091; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Google_Chat - Related TLS SNI (chat.google.com)"; tls.sni; content:"chat.google.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000092; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Threema - DNS request for threema.ch"; dns.query; content:"threema.ch"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Threema - Related URL (threema.ch)"; http.uri; content:"threema.ch"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000094; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Threema - Related TLS SNI (threema.ch)"; tls.sni; content:"threema.ch"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000095; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Wire - DNS request for wire.com"; dns.query; content:"wire.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Wire - Related URL (wire.com)"; http.uri; content:"wire.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000097; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Wire - Related TLS SNI (wire.com)"; tls.sni; content:"wire.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000098; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Element - DNS request for element.io"; dns.query; content:"element.io"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Element - Related URL (element.io)"; http.uri; content:"element.io"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000100; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Element - Related TLS SNI (element.io)"; tls.sni; content:"element.io"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000101; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Matrix - DNS request for matrix.org"; dns.query; content:"matrix.org"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Matrix - Related URL (matrix.org)"; http.uri; content:"matrix.org"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000103; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Matrix - Related TLS SNI (matrix.org)"; tls.sni; content:"matrix.org"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000104; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Session - DNS request for getsession.org"; dns.query; content:"getsession.org"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Session - Related URL (getsession.org)"; http.uri; content:"getsession.org"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000106; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Session - Related TLS SNI (getsession.org)"; tls.sni; content:"getsession.org"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000107; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - KakaoTalk - DNS request for kakaotalk.com"; dns.query; content:"kakaotalk.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - KakaoTalk - Related URL (kakaotalk.com)"; http.uri; content:"kakaotalk.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000109; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - KakaoTalk - Related TLS SNI (kakaotalk.com)"; tls.sni; content:"kakaotalk.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000110; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - KakaoTalk - DNS request for kakao.com"; dns.query; content:"kakao.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - KakaoTalk - Related URL (kakao.com)"; http.uri; content:"kakao.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000112; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - KakaoTalk - Related TLS SNI (kakao.com)"; tls.sni; content:"kakao.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000113; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_Messaging - Google_Meet - DNS request for meet.google.com"; dns.query; content:"meet.google.com"; nocase; reference:url,messaging; classtype:policy-violation; sid:52000114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_Messaging - Google_Meet - Related URL (meet.google.com)"; http.uri; content:"meet.google.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000115; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_Messaging - Google_Meet - Related TLS SNI (meet.google.com)"; tls.sni; content:"meet.google.com"; flow:to_server,established; reference:url,messaging; classtype:policy-violation; sid:52000116; rev:1;)