Examples

    alert tcp any 143 -> any any (msg:"IMAP login"; 
        content:"OK LOGIN"; flowbits:set,logged_in; 
        flowbits:noalert;)
      
    alert tcp any any -> any 143 (msg:"IMAP LIST"; content:"LIST"; 
        flowbits:isset,logged_in;)