alert tcp any any -> any 80 (msg:"Banned keyword!"; content:"cat"; nocase; sid:100002;)