<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<requestSequence xmlns="http://www.cisco.com/cids/idiom" schemaVersion="2.00" xmlns:enc="http://www.w3.org/2001/04/xmlenc#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
 <setTypedefs xmlns="http://www.cisco.com/cids/idconf">
   <component name="signatureDefinition"> <typedefs typedefsVersion="2008-02-29" xmlns="http://www.cisco.com/cids/idconf" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <tInteger typeName="Integer0-255"  min="0"  max="255" />
  <tInteger typeName="Integer0-65535"  min="0"  max="65535" />
  <tInteger typeName="Integer1-65535"  min="1"  max="65535" />
  <tInteger typeName="Integer0-131071"  min="0"  max="131071" />
  <tInteger typeName="Integer1-504"  min="1"  max="50"  default="4" />
  <tInteger typeName="Integer0-160001380"  min="0"  max="16000"  default="1380" />
  <tInteger typeName="Integer0-160000"  min="0"  max="16000"  default="0" />
  <tInteger typeName="Integer0-12832"  min="0"  max="128"  default="32" />
  <tInteger typeName="Integer1-605"  min="1"  max="60"  default="5" />
  <tInteger typeName="Integer3-30030"  min="3"  max="300"  default="30" />
  <tInteger typeName="Integer0-3600003600"  min="0"  max="360000"  default="3600" />
  <tInteger typeName="Integer0-36060"  min="0"  max="360"  default="60" />
  <tInteger typeName="Integer0-8192170"  min="0"  max="8192"  default="170" />
  <tInteger typeName="Integer1-82"  min="1"  max="8"  default="2" />
  <tInteger typeName="Integer8-1500400"  min="8"  max="1500"  default="400" />
  <tInteger typeName="Integer0-100001000"  min="0"  max="10000"  default="1000" />
  <tInteger typeName="Integer2000-6553665536"  min="2000"  max="65536"  default="65536" />
  <tInteger typeName="Integer0-4200010000"  min="0"  max="42000"  default="10000" />
  <tInteger typeName="Integer10000050"  max="100000"  default="50" />
  <tInteger typeName="Integer1-6553515"  min="1"  max="65535"  default="15" />
  <tInteger typeName="Integer0-300"  min="0"  max="30"  default="0" />
  <tInteger typeName="Integer1-360030"  min="1"  max="3600"  default="30" />
  <tInteger typeName="Integer" />
  <tInteger typeName="Integer0-2550"  min="0"  max="255"  default="0" />
  <tInteger typeName="Integer1-65535240"  min="1"  max="65535"  default="240" />
  <tInteger typeName="Integer0-65535120"  min="0"  max="65535"  default="120" />
  <tInteger typeName="Integer0-15"  min="0"  max="15" />
  <tInteger typeName="Integer0-63"  min="0"  max="63" />
  <tInteger typeName="Integer0-999999999"  min="0"  max="999999999" />
  <tInteger typeName="Integer0-1000000"  min="0"  max="1000000" />
  <tInteger typeName="Integer1000-65000"  min="1000"  max="65000" />
  <tInteger typeName="Integer0-655350"  min="0"  max="65535"  default="0" />
  <tInteger typeName="Integer1-655351"  min="1"  max="65535"  default="1" />
  <tInteger typeName="Integer1-100015"  min="1"  max="1000"  default="15" />
  <tInteger typeName="Integer0-10075"  min="0"  max="100"  default="75" />
  <tInteger typeName="Integer2-100060"  min="2"  max="1000"  default="60" />
  <tInteger typeName="Integer0-16"  min="0"  max="16" />
  <tInteger typeName="Integer0-360060"  min="0"  max="3600"  default="60" />
  <tInteger typeName="Integer0-1280"  min="0"  max="128"  default="0" />
  <tInteger typeName="Integer1-2561"  min="1"  max="256"  default="1" />
  <tInteger typeName="Integer0-42949672954294967295"  min="0"  max="4294967295"  default="4294967295" />
  <tInteger typeName="Integer0-4294967295"  min="0"  max="4294967295" />
  <tInteger typeName="Integer0-65535200"  min="0"  max="65535"  default="200" />
  <tInteger typeName="Integer1-15001300"  min="1"  max="1500"  default="1300" />
  <tInteger typeName="Integer1-655355"  min="1"  max="65535"  default="5" />
  <tInteger typeName="Integer1-100100"  min="1"  max="100"  default="100" />
  <tInteger typeName="Integer1-2501"  min="1"  max="250"  default="1" />
  <tInteger typeName="Integer0-250"  min="0"  max="250" />
  <tInteger typeName="Integer1-250"  min="1"  max="250" />
  <tIntegerRange typeName="IntegerRange0-65535am139comma445"  min="0"  max="65535"  allowMultiple="true"  default="139,445" />
  <tIntegerRange typeName="IntegerRange0-255am"  min="0"  max="255"  allowMultiple="true" />
  <tIntegerRange typeName="IntegerRange0-65535am"  min="0"  max="65535"  allowMultiple="true" />
  <tIntegerRange typeName="IntegerRange0-65535"  min="0"  max="65535" />
  <tIntegerRange typeName="IntegerRange0-65535am21"  min="0"  max="65535"  allowMultiple="true"  default="21" />
  <tIntegerRange typeName="IntegerRange0-65535am22"  min="0"  max="65535"  allowMultiple="true"  default="22" />
  <tIntegerRange typeName="IntegerRange0-18am0-18"  min="0"  max="18"  allowMultiple="true"  default="0-18" />
  <tIntegerRange typeName="IntegerRange1-65535"  min="1"  max="65535" />
  <tIntegerRange typeName="IntegerRange0-256"  min="0"  max="256" />
  <tIntegerRange typeName="IntegerRange0-18am18"  min="0"  max="18"  allowMultiple="true"  default="18" />
  <tIpV4AddrRange typeName="IpV4AddrRangeam"  allowMultiple="true" />
  <tString typeName="String"  pattern="^[\r\n\t\x20-\xff]+$" />
  <tString typeName="Stringaa"  pattern="^[\r\n\t\x20-\xff]+$"  allowAnything="true" />
  <tString typeName="String0-custom"  min="0"  default="custom" />
  <tString typeName="StringaaMy_Sig"  pattern="^[\r\n\t\x20-\xff]+$"  allowAnything="true"  default="My Sig" />
  <tString typeName="String0-aaMy_Sig_Info"  pattern="^[\r\n\t\x20-\xff]+$"  min="0"  allowAnything="true"  default="My Sig Info" />
  <tString typeName="String0-aaSig_Comment"  pattern="^[\r\n\t\x20-\xff]+$"  min="0"  allowAnything="true"  default="Sig Comment" />
  <tString typeName="StringaaRegex_String"  pattern="^[\r\n\t\x20-\xff]+$"  allowAnything="true"  default="Regex String" />
  <tEnum typeName="Bool" min="1" max="1">
    <value name="false" guiName="No" descr="Set parameter to false"/>
    <value name="true" guiName="Yes" descr="Set parameter to true"/>
  </tEnum>
  <tEnum typeName="Enum49225" min="1" max="1" default="bi-dir">
    <value name="to-service" guiName="To Service" descr="Traffic from client to service ports"/>
    <value name="from-service" guiName="From Service" descr="Traffic from service port to client"/>
    <value name="bi-dir" guiName="Bi-Directional" descr="Inspect both directions (default)"/>
  </tEnum>
  <tEnum typeName="Enum47389" min="0" max="10" default="produce-alert">
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="request-block-host" guiName="Request Block Host" descr="Request blocking on the attacking host by configured devices"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
    <value name="deny-connection-inline" guiName="Deny Connection Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the TCP Flow."/>
    <value name="request-block-connection" guiName="Request Block Connection" descr="request NAC to shun this connection"/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time."/>
  </tEnum>
  <tEnum typeName="Enum47401" min="0" max="10" default="produce-alert">
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="request-block-host" guiName="Request Block Host" descr="Request blocking on the attacking host by configured devices"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
  </tEnum>
  <tEnum typeName="Enum47422"   >
    <value name="tcp-data" guiName="TCP Data" descr="TCP data inspection"/>
    <value name="tns-data" guiName="TNS Data" descr="TNS data inspection"/>
  </tEnum>
  <tEnum typeName="Enum47432" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum47450" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum47472" min="1" max="6" >
    <value name="conc-mpx" guiName="Concurrent Execution" descr="conc-mpx flag"/>
    <value name="did-not-execute" guiName="Did Not Execute" descr="did-not-execute flag"/>
    <value name="first-frag" guiName="First Fragment" descr="first-frag flag"/>
    <value name="last-frag" guiName="Last Fragment" descr="last-frag flag"/>
    <value name="maybe" guiName="Maybe Semantics" descr="maybe flag"/>
    <value name="object-uuid" guiName="Object UUID" descr="UUID for MSRPC object"/>
    <value name="pending-cancel" guiName="Pending Cancel" descr="pending-cancel flag"/>
    <value name="reserved" guiName="Reserved" descr="reserved flag"/>
  </tEnum>
  <tEnum typeName="Enum47481" min="1" max="6" >
    <value name="conc-mpx" guiName="Concurrent Execution" descr="conc-mpx flag"/>
    <value name="did-not-execute" guiName="Did Not Execute" descr="did-not-execute flag"/>
    <value name="first-frag" guiName="First Fragment" descr="first-frag flag"/>
    <value name="last-frag" guiName="Last Fragment" descr="last-frag flag"/>
    <value name="maybe" guiName="Maybe Semantics" descr="maybe flag"/>
    <value name="object-uuid" guiName="Object UUID" descr="UUID for MSRPC object"/>
    <value name="pending-cancel" guiName="Pending Cancel" descr="pending-cancel flag"/>
    <value name="reserved" guiName="Reserved" descr="reserved flag"/>
  </tEnum>
  <tEnum typeName="Enum47488"   >
    <value name="resource-data" guiName="Resource" descr="SMB Resource"/>
    <value name="smb-data" guiName="SMB Data" descr="SMB data inspection"/>
    <value name="tcp-data" guiName="TCP Data" descr="TCP data inspection"/>
  </tEnum>
  <tEnum typeName="Enum47523" min="1" max="15" default="general-os">
    <value name="general-os" guiName="General OS" descr="All OS types"/>
    <value name="ios" guiName="IOS" descr="Variants of Cisco IOS"/>
    <value name="mac-os" guiName="Mac OS" descr="Variants of Mac OS"/>
    <value name="netware" guiName="Netware" descr="Netware"/>
    <value name="other" guiName="Other" descr="Any other OS"/>
    <value name="unix" guiName="UNIX" descr="Variants of UNIX"/>
    <value name="aix" guiName="AIX" descr="Variants of AIX"/>
    <value name="bsd" guiName="BSD" descr="Variants of BSD"/>
    <value name="hp-ux" guiName="HP-UX" descr="Variants of HP-UX"/>
    <value name="irix" guiName="IRIX" descr="Variants of IRIX"/>
    <value name="linux" guiName="Linux" descr="Variants of Linux"/>
    <value name="solaris" guiName="Solaris" descr="Variants of Solaris"/>
    <value name="windows" guiName="Windows" descr="Variants of Microsoft Windows"/>
    <value name="windows-nt-2k-xp" guiName="Windows NT/2K/XP" descr="Variants of NT, 2000, and XP"/>
    <value name="win-nt" guiName="Windows NT" descr="Specific variants of Windows NT"/>
  </tEnum>
  <tEnum typeName="Enum47539" min="1" max="6" >
    <value name="broadcast" guiName="Broadcast" descr="broadcast flag."/>
    <value name="frag" guiName="Fragment" descr="frag flag"/>
    <value name="idempotent" guiName="Idempotent" descr="idempotent flag"/>
    <value name="last-frag" guiName="Last Fragment" descr="last-frag flag"/>
    <value name="maybe" guiName="Maybe Semantic" descr="maybe flag"/>
    <value name="no-fack" guiName="No FACK" descr="no-fack flag"/>
    <value name="reserved01" guiName="Reserved bit 1" descr="reserved01 flag"/>
    <value name="reserved08" guiName="Reserved bit 8" descr="reserved08 flag"/>
  </tEnum>
  <tEnum typeName="Enum47569" min="0" max="16" default="produce-alert">
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-connection-inline" guiName="Deny Connection Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the TCP Flow."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="request-block-connection" guiName="Request Block Connection" descr="request NAC to shun this connection"/>
    <value name="request-block-host" guiName="Request Block Host" descr="request NAC to shun this attacker host"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
    <value name="reset-tcp-connection" guiName="Reset TCP Connection" descr="send TCP RESETS to hijack and terminate the TCP Flow."/>
    <value name="modify-packet-inline" guiName="Modify Packet Inline" descr="INLINE ONLY: modify packet contents"/>
    <value name="request-rate-limit" guiName="Request Rate Limit" descr="Activate rate limiting."/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
  </tEnum>
  <tEnum typeName="Enum47643"   >
    <value name="tcp" guiName="TCP" descr="TCP protocol"/>
    <value name="udp" guiName="UDP" descr="UDP protocol"/>
  </tEnum>
  <tEnum typeName="Enum47649"   >
    <value name="Axxx" guiName="Attacker address" descr="Attacker address"/>
    <value name="AxBx" guiName="Attacker and victim addresses" descr="Attacker and victim addresses"/>
    <value name="xxBx" guiName="Victim address" descr="Victim address"/>
    <value name="xxxx" guiName="Global" descr="Global"/>
  </tEnum>
  <tEnum typeName="Enum47651"   >
    <value name="tcp" guiName="TCP" descr="TCP protocol"/>
    <value name="udp" guiName="UDP" descr="UDP protocol"/>
  </tEnum>
  <tEnum typeName="Enum47676"   default="any">
    <value name="any" guiName="Any" descr="Any fragment status"/>
    <value name="no-fragments" guiName="Not Fragmented" descr="Fragments are not inspected"/>
    <value name="want-fragments" guiName="Fragmented" descr="Fragments are inspected"/>
  </tEnum>
  <tEnum typeName="Enum47756" min="1" max="6" >
    <value name="conc-mpx" guiName="Concurrent Execution" descr="conc-mpx flag"/>
    <value name="did-not-execute" guiName="Did Not Execute" descr="did-not-execute flag"/>
    <value name="first-frag" guiName="First Fragment" descr="first-frag flag"/>
    <value name="last-frag" guiName="Last Fragment" descr="last-frag flag"/>
    <value name="maybe" guiName="Maybe Semantics" descr="maybe flag"/>
    <value name="object-uuid" guiName="Object UUID" descr="UUID for MSRPC object"/>
    <value name="pending-cancel" guiName="Pending Cancel" descr="pending-cancel flag"/>
    <value name="reserved" guiName="Reserved" descr="reserved flag"/>
  </tEnum>
  <tEnum typeName="Enum47769"   >
    <value name="Axxx" guiName="Attacker address" descr="Attacker address"/>
    <value name="AxBx" guiName="Attacker and victim addresses" descr="Attacker and victim addresses"/>
    <value name="Axxb" guiName="Attacker address and victim port" descr="Attacker address and victim port"/>
  </tEnum>
  <tEnum typeName="Enum47780" min="0" max="6" >
    <value name="urg" guiName="URG" descr="URG bit"/>
    <value name="ack" guiName="ACK" descr="ACK bit"/>
    <value name="psh" guiName="PSH" descr="PSH bit"/>
    <value name="rst" guiName="RST" descr="RST bit"/>
    <value name="syn" guiName="SYN" descr="SYN bit"/>
    <value name="fin" guiName="FIN" descr="FIN bit"/>
  </tEnum>
  <tEnum typeName="Enum47809" min="1" max="1" default="Axxx">
    <value name="Axxx" guiName="Attacker address" descr="Attacker address"/>
    <value name="AxBx" guiName="Attacker and victim addresses" descr="Attacker and victim addresses"/>
    <value name="Axxb" guiName="Attacker address and victim port" descr="Attacker address and victim port"/>
    <value name="xxBx" guiName="Victim address" descr="Victim address"/>
    <value name="AaBb" guiName="Attacker and victim addresses and ports" descr="Attacker and victim addresses and ports"/>
  </tEnum>
  <tEnum typeName="Enum47821"   >
    <value name="abort" guiName="Abort" descr="Abort state to end LPR Format String inspection"/>
    <value name="mail-body" guiName="Mail Body" descr="mail-body state"/>
    <value name="mail-header" guiName="Mail Header" descr="mail-header state"/>
    <value name="smtp-commands" guiName="Smtp Commands" descr="SMTP commands state of SMTP protocol"/>
    <value name="start" guiName="Start" descr="State state"/>
  </tEnum>
  <tEnum typeName="Enum47838"   >
    <value name="bad-port-cmd-address" guiName="Invalid Address in PORT Command" descr="Ftp command has a bad port cmd address"/>
    <value name="bad-port-cmd-port" guiName="Invalid Port in PORT Command" descr="Ftp command has a bad port cmd port"/>
    <value name="pasv" guiName="PASV Port Spoof" descr="pasv command"/>
  </tEnum>
  <tEnum typeName="Enum47867" min="0" max="14" default="produce-alert">
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-connection-inline" guiName="Deny Connection Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the TCP Flow."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="request-block-connection" guiName="Request Block Connection" descr="request NAC to shun this connection"/>
    <value name="request-block-host" guiName="Request Block Host" descr="request NAC to shun this attacker host"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
    <value name="reset-tcp-connection" guiName="Reset TCP Connection" descr="send TCP RESETS to hijack and terminate the TCP Flow."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time. "/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time. "/>
  </tEnum>
  <tEnum typeName="Enum47918" min="0"  >
    <value name="length" guiName="Length Check" descr="Keys larger than this will fire RSAREF overflow."/>
    <value name="presence" guiName="Presence" descr="Presence inspection"/>
    <value name="regex" guiName="Regex" descr="Regular expression inspection"/>
    <value name="validate" guiName="Field Validation" descr="Validate inspection"/>
    <value name="value" guiName="Value" descr="Valud inspection"/>
  </tEnum>
  <tEnum typeName="Enum47979" min="0" max="14" default="produce-alert">
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-connection-inline" guiName="Deny Connection Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the TCP Flow."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="request-block-connection" guiName="Request Block Connection" descr="request NAC to shun this connection"/>
    <value name="request-block-host" guiName="Request Block Host" descr="request NAC to shun this attacker host"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
    <value name="reset-tcp-connection" guiName="Reset TCP Connection" descr="send TCP RESETS to hijack and terminate the TCP Flow."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time."/>
  </tEnum>
  <tEnum typeName="Enum47983"   >
    <value name="Axxx" guiName="Attacker address" descr="Attacker address"/>
    <value name="AxBx" guiName="Attacker and victim addresses" descr="Attacker and victim addresses"/>
    <value name="Axxb" guiName="Attacker address and victim port" descr="Attacker address and victim port"/>
  </tEnum>
  <tEnum typeName="Enum47987"   >
    <value name="Axxx" guiName="Attacker address" descr="Attacker address"/>
    <value name="AxBx" guiName="Attacker and victim addresses" descr="Attacker and victim addresses"/>
    <value name="Axxb" guiName="Attacker address and victim port" descr="Attacker address and victim port"/>
  </tEnum>
  <tEnum typeName="Enum48027" min="0" max="14" default="produce-alert">
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-connection-inline" guiName="Deny Connection Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the TCP Flow."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="request-block-connection" guiName="Request Block Connection" descr="request NAC to shun this connection"/>
    <value name="request-block-host" guiName="Request Block Host" descr="request NAC to shun this attacker host"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
    <value name="reset-tcp-connection" guiName="Reset TCP Connection" descr="send TCP RESETS to hijack and terminate the TCP Flow."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time."/>
  </tEnum>
  <tEnum typeName="Enum48028" min="0" max="10" default="produce-alert">
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="request-block-host" guiName="Request Block Host" descr="Request blocking on the attacking host by configured devices"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
  </tEnum>
  <tEnum typeName="Enum48147" min="0"  >
    <value name="asn.1-per" guiName="ASN.1-PER" descr="asn.1-per message type"/>
    <value name="q.931" guiName="Q.931" descr="q.931 message type"/>
    <value name="setup" guiName="SETUP" descr="Setup H225 message"/>
    <value name="tpkt" guiName="TPKT" descr="TPKT"/>
  </tEnum>
  <tEnum typeName="Enum48148" min="1" max="1" >
    <value name="abor" guiName="abor" descr="abor command"/>
    <value name="acct" guiName="acct" descr="acct command"/>
    <value name="allo" guiName="allo" descr="allo command"/>
    <value name="appe" guiName="appe" descr="appe command"/>
    <value name="cdup" guiName="cdup" descr="cdup command"/>
    <value name="cwd" guiName="cwd" descr="cwd  command"/>
    <value name="dele" guiName="dele" descr="dele command"/>
    <value name="help" guiName="Help" descr="help command"/>
    <value name="list" guiName="list" descr="list command"/>
    <value name="mkd" guiName="mkd" descr="mkd  command"/>
    <value name="mode" guiName="mode" descr="mode command"/>
    <value name="nlst" guiName="nlst" descr="nlst command"/>
    <value name="noop" guiName="Noop" descr="noop command"/>
    <value name="pass" guiName="pass" descr="pass command"/>
    <value name="pasv" guiName="pasv" descr="pasv command"/>
    <value name="port" guiName="port" descr="port command"/>
    <value name="pwd" guiName="pwd" descr="pwd  command"/>
    <value name="quit" guiName="quit" descr="quit command"/>
    <value name="rein" guiName="rein" descr="rein command"/>
    <value name="rest" guiName="rest" descr="rest command"/>
    <value name="retr" guiName="retr" descr="retr command"/>
    <value name="rmd" guiName="rmd" descr="rmd  command"/>
    <value name="rnfr" guiName="rnfr" descr="rnfr command"/>
    <value name="rnto" guiName="rnto" descr="rnto command"/>
    <value name="site" guiName="site" descr="site command"/>
    <value name="smnt" guiName="smnt" descr="smnt command"/>
    <value name="stat" guiName="Stat" descr="stat command"/>
    <value name="stor" guiName="stor" descr="stor command"/>
    <value name="stou" guiName="stou" descr="stou command"/>
    <value name="stru" guiName="stru" descr="stru command"/>
    <value name="syst" guiName="Syst" descr="syst command"/>
    <value name="type" guiName="type" descr="type command"/>
    <value name="user" guiName="User" descr="user command"/>
  </tEnum>
  <tEnum typeName="Enum48159" min="0" max="6" >
    <value name="urg" guiName="Urg" descr="URG bit"/>
    <value name="ack" guiName="Ack" descr="ACK bit"/>
    <value name="psh" guiName="Psh" descr="PSH bit"/>
    <value name="rst" guiName="Rst" descr="RST bit"/>
    <value name="syn" guiName="Syn" descr="SYN bit"/>
    <value name="fin" guiName="Fin" descr="FIN bit"/>
  </tEnum>
  <tEnum typeName="Enum48186"   >
    <value name="dst-broadcast" guiName="Dst Broadcast" descr="Destination broadcast inspection"/>
    <value name="same-src-dst" guiName="Same Src and Dst" descr="Inspection for source and destination addresses being the same"/>
    <value name="src-broadcast" guiName="Src Broadcast" descr="Source broadcast ARP inspection"/>
    <value name="src-multicast" guiName="Src Multicast" descr="Source multicast ARP inspection"/>
  </tEnum>
  <tEnum typeName="Enum48213" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum48253" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum48275" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum48302"   >
    <value name="icmp-data" guiName="ICMP Data" descr="ICMP data to inspect for"/>
    <value name="l2-header" guiName="Layer2 Header" descr="Layer 2 header"/>
    <value name="l3-header" guiName="Layer3 Header" descr="Layer 3 header"/>
    <value name="l4-header" guiName="Layer4 Header" descr="Layer 4 header"/>
    <value name="tcp-data" guiName="TCP Data" descr="TCP data inspection"/>
    <value name="udp-data" guiName="UDP Data" descr="UDP data inspection"/>
    <value name="tcp-stream" guiName="TCP Stream" descr="TCP Stream Inspection"/>
  </tEnum>
  <tEnum typeName="Enum48306" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum48314" min="1" max="6" >
    <value name="conc-mpx" guiName="Concurrent Execution" descr="conc-mpx flag"/>
    <value name="did-not-execute" guiName="Did Not Execute" descr="did-not-execute flag"/>
    <value name="first-frag" guiName="First Fragment" descr="first-frag flag"/>
    <value name="last-frag" guiName="Last Fragment" descr="last-frag flag"/>
    <value name="pending-cancel" guiName="Pending Cancel" descr="pending-cancel flag"/>
    <value name="reserved" guiName="Reserved" descr="reserved flag"/>
    <value name="maybe" guiName="Maybe Semantics" descr="maybe flag"/>
    <value name="object-uuid" guiName="Object UUID" descr="UUID for MSRPC object"/>
  </tEnum>
  <tEnum typeName="Enum48317" min="1" max="1" >
    <value name="cisco-device" guiName="Cisco Device" descr="cisco-device state"/>
    <value name="control-c" guiName="Control C" descr="control-c state"/>
    <value name="pass-prompt" guiName="Pass Prompt" descr="Password prompt state"/>
    <value name="start" guiName="Start" descr="State state"/>
  </tEnum>
  <tEnum typeName="Enum48322" min="1" max="1" >
    <value name="abort" guiName="Abort" descr="Abort state to end LPR Format String inspection"/>
    <value name="format-char" guiName="Format Char" descr="format-char state"/>
    <value name="start" guiName="Start" descr="State state"/>
  </tEnum>
  <tEnum typeName="Enum48328" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum48335" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum48348" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum48369"   default="any">
    <value name="any" guiName="Any" descr="Any fragment status"/>
    <value name="no-fragments" guiName="Not Fragmented" descr="Fragments are not inspected"/>
    <value name="want-fragments" guiName="Fragmented" descr="Fragments are inspected"/>
  </tEnum>
  <tEnum typeName="Enum48374" min="0" max="6" >
    <value name="urg" guiName="URG" descr="URG bit"/>
    <value name="ack" guiName="ACK" descr="ACK bit"/>
    <value name="psh" guiName="PSH" descr="PSH bit"/>
    <value name="rst" guiName="RST" descr="RST bit"/>
    <value name="syn" guiName="SYN" descr="SYN bit"/>
    <value name="fin" guiName="FIN" descr="FIN bit"/>
  </tEnum>
  <tEnum typeName="Enum48375" min="0" max="6" >
    <value name="urg" guiName="URG" descr="URG bit"/>
    <value name="ack" guiName="ACK" descr="ACK bit"/>
    <value name="psh" guiName="PSH" descr="PSH bit"/>
    <value name="rst" guiName="RST" descr="RST bit"/>
    <value name="syn" guiName="SYN" descr="SYN bit"/>
    <value name="fin" guiName="FIN" descr="FIN bit"/>
  </tEnum>
  <tEnum typeName="Enum48404" min="1" max="1" default="Axxx">
    <value name="Axxx" guiName="Attacker address" descr="Attacker address"/>
    <value name="AxBx" guiName="Attacker and victim addresses" descr="Attacker and victim addresses"/>
    <value name="Axxb" guiName="Attacker address and victim port" descr="Attacker address and victim port"/>
    <value name="xxBx" guiName="Victim address" descr="Victim address"/>
    <value name="AaBb" guiName="Attacker and victim addresses and ports" descr="Attacker and victim addresses and ports"/>
  </tEnum>
  <tEnum typeName="Enum48410" min="1" max="1" default="Axxx">
    <value name="Axxx" guiName="Attacker address" descr="Attacker address"/>
    <value name="AxBx" guiName="Attacker and victim addresses" descr="Attacker and victim addresses"/>
    <value name="Axxb" guiName="Attacker address and victim port" descr="Attacker address and victim port"/>
    <value name="xxBx" guiName="Victim address" descr="Victim address"/>
    <value name="AaBb" guiName="Attacker and victim addresses and ports" descr="Attacker and victim addresses and ports"/>
  </tEnum>
  <tEnum typeName="Enum48418" min="1" max="1" default="medium">
    <value name="high" guiName="High" descr="Dangerous Alert."/>
    <value name="medium" guiName="Medium" descr="Medium level alert"/>
    <value name="low" guiName="Low" descr="Low level alert"/>
    <value name="informational" guiName="Informational" descr="Informational alert."/>
  </tEnum>
  <tEnum typeName="Enum48422" min="1" max="1" default="Axxx">
    <value name="Axxx" guiName="Attacker address" descr="Attacker address"/>
    <value name="AxBx" guiName="Attacker and victim addresses" descr="Attacker and victim addresses"/>
    <value name="Axxb" guiName="Attacker address and victim port" descr="Attacker address and victim port"/>
    <value name="xxBx" guiName="Victim address" descr="Victim address"/>
    <value name="AaBb" guiName="Attacker and victim addresses and ports" descr="Attacker and victim addresses and ports"/>
  </tEnum>
  <tEnum typeName="Enum48436" min="0" max="6" >
    <value name="urg" guiName="URG" descr="URG bit"/>
    <value name="ack" guiName="ACK" descr="ACK bit"/>
    <value name="psh" guiName="PSH" descr="PSH bit"/>
    <value name="rst" guiName="RST" descr="RST bit"/>
    <value name="syn" guiName="SYN" descr="SYN bit"/>
    <value name="fin" guiName="FIN" descr="FIN bit"/>
  </tEnum>
  <tEnum typeName="Enum48453" min="0" max="12" default="produce-alert">
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="request-block-host" guiName="Request Block Host" descr="Request blocking on the attacking host by configured devices"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
    <value name="request-block-connection" guiName="Request Block Connection" descr="request NAC to shun this connection"/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time."/>
  </tEnum>
  <tEnum typeName="Enum48483" min="0" max="12" default="produce-alert">
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
    <value name="request-block-host" guiName="Request Block Host" descr="Request blocking on the attacking host by configured devices"/>
    <value name="request-rate-limit" guiName="Request Rate Limit" descr="Activate Rate Limiting"/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time."/>
  </tEnum>
  <tEnum typeName="Enum48492" min="1" max="6" >
    <value name="broadcast" guiName="Broadcast" descr="broadcast flag."/>
    <value name="frag" guiName="Fragment" descr="frag flag"/>
    <value name="idempotent" guiName="Idempotent" descr="idempotent flag"/>
    <value name="last-frag" guiName="Last Fragment" descr="last-frag flag"/>
    <value name="maybe" guiName="Maybe Semantic" descr="maybe flag"/>
    <value name="no-fack" guiName="No FACK" descr="no-fack flag"/>
    <value name="reserved01" guiName="Reserved bit 1" descr="reserved01 flag"/>
    <value name="reserved08" guiName="Reserved bit 8" descr="reserved08 flag"/>
  </tEnum>
  <tEnum typeName="Enum48548" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum48637" min="0" max="13" default="produce-alert">
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="request-block-connection" guiName="Request Block Connection" descr="request NAC to shun this connection"/>
    <value name="request-block-host" guiName="Request Block Host" descr="Request blocking on the attacking host by configured devices"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
  </tEnum>
  <tEnum typeName="Enum48711" min="0" max="4" default="produce-alert">
    <value name="produce-alert" guiName="Produce Alert" descr="produce-alert"/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="produce-verbose-alert"/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="deny-packet-inline"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="request-snmp-trap"/>
  </tEnum>
  <tEnum typeName="Enum48726" min="0" max="32" default="Info/Misc">
    <value name="ApplPolicyViolation/Misc" guiName="ApplPolicyViolation/Misc" descr="This group includes events triggered when miscellaneous applications drop a packet because of the application level policy violations."/>
    <value name="ApplPolicyViolation/Web" guiName="ApplPolicyViolation/Web" descr="This group includes events triggered when a web server denies a packet because of web server policy violations."/>
    <value name="AttacksProtected" guiName="AttacksProtected" descr="This group includes events trigerred when a intrusion protection device is statically configured to drop an attack."/>
    <value name="ConfigError/CiscoCatOS" guiName="ConfigError/CiscoCatOS" descr="This group includes events that indicate a configuration error on a Cisco catalyst switch running Catalyst operating system. Configuration errors cause improper operation of the switch."/>
    <value name="ConfigError/CiscoIOS" guiName="ConfigError/CiscoIOS" descr="This group includes events that indicate a configuration error on a Cisco switch/router running IOS. Configuration errors cause improper operation of the switch."/>
    <value name="ConfigError/CiscoPix" guiName="ConfigError/CiscoPix" descr="This group includes events that indicate a configuration error on a Cisco PIX firewall. Configuration errors cause improper operation of the firewall."/>
    <value name="ConfigError/CiscoVPNConc" guiName="ConfigError/CiscoVPNConc" descr="This group includes events that indicate a configuration error on a Cisco VPN Concentrator. Configuration errors cause improper operation of the switch."/>
    <value name="ConfigError/Host" guiName="ConfigError/Host" descr="This group includes events that indicate an configuration error on a host application. "/>
    <value name="ConfigError/NetScreenFirewall" guiName="ConfigError/NetScreenFirewall" descr="This group includes events that indicate a configuration error on a Netscreen firewall running ScreenOS operating system. Configuration errors cause improper operation of the firewall."/>
    <value name="ConfigError/Network" guiName="ConfigError/Network" descr="This group includes events that indicate a network configuration error prventing packets to reach the destination. This includes ICMP unreachables, ICMP time exceeded, duplicate addresses etc."/>
    <value name="DoS/All" guiName="DoS/All" descr="This group includes all events that indicate denial of service, including DoS to network, to network devices, to certain hosts, to various servers like mail servers and web servers, or distributed DoS activity."/>
    <value name="DoS/DBServer" guiName="DoS/DBServer" descr="This group includes events that indicate attempts to crash or cause a denial of service on a database server."/>
    <value name="DoS/DNS" guiName="DoS/DNS" descr="This group includes events that indicate attempts to crash or cause a denial of service on a DNS server."/>
    <value name="DoS/Distributed" guiName="DoS/Distributed" descr="This group includes events that indicate distributed denial of service attacks e.g. from tools such as TFN, Trinoo, Mstream etc."/>
    <value name="DoS/FTPServer" guiName="DoS/FTPServer" descr="This group includes events that indicate attempts to crash or cause a denial of service on an FTP server."/>
    <value name="DoS/Host" guiName="DoS/Host" descr="This group includes events that indicate attempts to crash or cause a denial of service on a host."/>
    <value name="DoS/MailServer" guiName="DoS/MailServer" descr="This group includes events that indicate attempts to crash or cause a denial of service on a mail server running SMTP, IMAP or POP."/>
    <value name="DoS/MiscServer" guiName="DoS/MiscServer" descr="This group includes events that indicate attempts to crash or cause a denial of service on a generic server."/>
    <value name="DoS/ModbusServer" guiName="DoS/ModbusServer" descr="This group includes events that indicate attempts to crash or cause a denial of service on a MODBUS server. MODBUS is the protocol of choice in a Supervisory Control and Data Acquisition (SCADA) communications network."/>
    <value name="DoS/Network/ICMP" guiName="DoS/Network/ICMP" descr="This group includes events that indicate a network level denial of service using the ICMP protocol."/>
    <value name="DoS/Network/Misc" guiName="DoS/Network/Misc" descr="This group includes miscellaneous events that indicate a high network usage."/>
    <value name="DoS/Network/TCP" guiName="DoS/Network/TCP" descr="This group includes events that indicate a network level denial of service using the TCP protocol."/>
    <value name="DoS/Network/UDP" guiName="DoS/Network/UDP" descr="This group includes events that indicate a network level denial of service using the UDP protocol."/>
    <value name="DoS/NetworkDevice" guiName="DoS/NetworkDevice" descr="This group includes events that indicate attempts to crash or cause a denial of service on network infrastructure devices such as routers, switches, AAA servers etc. "/>
    <value name="DoS/RPCService" guiName="DoS/RPCService" descr="This group includes events that indicate attempts to crash or cause a denial of service on a RPC service on a host. "/>
    <value name="DoS/SMBService" guiName="DoS/SMBService" descr="This group includes events that indicate attempts to crash or cause a denial of service on the SMB service on a host."/>
    <value name="DoS/Sniffer" guiName="DoS/Sniffer" descr="This group includes events that indicate attempts to crash or cause a denial of service on a network sniffer such as a network IDS. "/>
    <value name="DoS/TelnetServer" guiName="DoS/TelnetServer" descr="This group includes events that indicate attempts to crash or cause a denial of service on a Telnet server."/>
    <value name="DoS/WebServer" guiName="DoS/WebServer" descr="This group includes events that indicate attempts to crash or cause a denial of service on a web server."/>
    <value name="FirewallPolicyViolation/AAA" guiName="FirewallPolicyViolation/AAA" descr="This group includes events triggered when a firewall denies a packet because of AAA policy violations and AAA access control list checks."/>
    <value name="FirewallPolicyViolation/ACL" guiName="FirewallPolicyViolation/ACL" descr="This group includes events triggered when a firewall denies a packet because of access control list checks."/>
    <value name="FirewallPolicyViolation/All" guiName="FirewallPolicyViolation/All" descr="This group includes all events triggered when a firewall denies a packet because of missing or incorrect NAT translations, various policy violations and access control list checks related to AAA, IPSec, SSL VPN, PPP and other protocol violations."/>
    <value name="FirewallPolicyViolation/IPSec" guiName="FirewallPolicyViolation/IPSec" descr="This group includes events triggered when a firewall denies a packet because of IPSec policy violations and/or IPSec access control list checks."/>
    <value name="FirewallPolicyViolation/Misc" guiName="FirewallPolicyViolation/Misc" descr="This group includes events triggered when a firewall denies a packet because of various protocol policy violations."/>
    <value name="FirewallPolicyViolation/NAT" guiName="FirewallPolicyViolation/NAT" descr="This group includes events triggered when a firewall denies a packet because of missing or incorrect NAT translations."/>
    <value name="FirewallPolicyViolation/PPP" guiName="FirewallPolicyViolation/PPP" descr="This group includes events triggered when a firewall denies a packet because of PPP policy violations."/>
    <value name="FirewallPolicyViolation/SSLVPN" guiName="FirewallPolicyViolation/SSLVPN" descr="This group includes events triggered when a firewall denies a packet because of SSL VPN policy violations and/or SSL VPN access control list checks."/>
    <value name="Info/AllSession" guiName="Info/AllSession" descr="This group includes events which indicate a IP session was established between two end points."/>
    <value name="Info/DTM" guiName="Info/DTM" descr="This group includes informational events from Cisco IOS Distributed Threat Mitigation."/>
    <value name="Info/DetailedTracking/Host" guiName="Info/DetailedTracking/Host" descr="This group includes events that tracks operations in detail on a host."/>
    <value name="Info/FailedAuth/AAA" guiName="Info/FailedAuth/AAA" descr="This group includes all events that indicate failed authentication at the AAA servers. The events can include user credential errors or attacks, configuration, network and operational errors. "/>
    <value name="Info/HighUsage/CS-MARS" guiName="Info/HighUsage/CS-MARS" descr="This group includes events that indicate high resource usage conditions (e.g. events or netflows dropped) on the CS-MARS device."/>
    <value name="Info/HighUsage/Host" guiName="Info/HighUsage/Host" descr="This group includes events that indicate high resource usage conditions (e.g. CPU, memory etc.) on a host."/>
    <value name="Info/HighUsage/NetworkDevice" guiName="Info/HighUsage/NetworkDevice" descr="This group includes events that indicate high resource usage conditions (e.g. CPU, memory etc.) on a network device."/>
    <value name="Info/Misc" guiName="Info/Misc" descr="This group includes generic informational events."/>
    <value name="Info/Misc/AAA" guiName="Info/Misc/AAA" descr="This group includes generic informational events from AAA servers."/>
    <value name="Info/Misc/AntiVirus" guiName="Info/Misc/AntiVirus" descr="This group includes generic informational events on Anti-virus agent activity on desktops."/>
    <value name="Info/Misc/CICS" guiName="Info/Misc/CICS" descr="This group includes generic informational events from Cisco Incident Control Servers."/>
    <value name="Info/Misc/CS-MARS" guiName="Info/Misc/CS-MARS" descr="This group includes informational events pertaining to the CS-MARS device, e.g. Database partition filling up, etc."/>
    <value name="Info/Misc/CiscoVPNConc" guiName="Info/Misc/CiscoVPNConc" descr="This group includes generic informational events from Cisco VPN Concentrators."/>
    <value name="Info/Misc/DB" guiName="Info/Misc/DB" descr="This group includes generic informational events on database servers."/>
    <value name="Info/Misc/DHCP" guiName="Info/Misc/DHCP" descr="This group includes generic informational events from DHCP protocol."/>
    <value name="Info/Misc/DNS" guiName="Info/Misc/DNS" descr="This group includes generic informational events on DNS servers."/>
    <value name="Info/Misc/EAPoUDP" guiName="Info/Misc/EAPoUDP" descr="This group includes generic informational events on the EAPoUDP protocol which is used by Network Admission Control capable Cisco Network Access Devices to communicate with AAA servers. "/>
    <value name="Info/Misc/FTP" guiName="Info/Misc/FTP" descr="This group includes generic informational events on FTP protocol"/>
    <value name="Info/Misc/FW" guiName="Info/Misc/FW" descr="This group includes generic informational events from firewalls."/>
    <value name="Info/Misc/GTP" guiName="Info/Misc/GTP" descr="This group includes generic informational events from GTP protocol."/>
    <value name="Info/Misc/H323" guiName="Info/Misc/H323" descr="This group includes generic informational events from H323 protocol."/>
    <value name="Info/Misc/Host" guiName="Info/Misc/Host" descr="This group includes generic informational events on hosts.  "/>
    <value name="Info/Misc/IDS" guiName="Info/Misc/IDS" descr="This group includes generic informational events from Network or Host IDS devices."/>
    <value name="Info/Misc/IPSec" guiName="Info/Misc/IPSec" descr="This group includes generic informational events from IPSec protocol."/>
    <value name="Info/Misc/L2TP" guiName="Info/Misc/L2TP" descr="This group includes generic informational events from L2TP protocol."/>
    <value name="Info/Misc/LDAP" guiName="Info/Misc/LDAP" descr="This group includes generic informational events from LDAP protocol."/>
    <value name="Info/Misc/Login" guiName="Info/Misc/Login" descr="This group includes generic informational events on services that provide login e.g. telnet, ssh, r-protocols."/>
    <value name="Info/Misc/Mail" guiName="Info/Misc/Mail" descr="This group includes generic informational events on mail protocols SMTP, IMAP, POP."/>
    <value name="Info/Misc/Modbus" guiName="Info/Misc/Modbus" descr="This group includes generic informational events regarding Modbus, Scada, and DNP."/>
    <value name="Info/Misc/NFS" guiName="Info/Misc/NFS" descr="This group includes generic informational events from NFS protocol."/>
    <value name="Info/Misc/NNTP" guiName="Info/Misc/NNTP" descr="This group includes generic informational events from NNTP protocol."/>
    <value name="Info/Misc/NetBios" guiName="Info/Misc/NetBios" descr="This group includes generic informational events from NetBios protocol."/>
    <value name="Info/Misc/PPP" guiName="Info/Misc/PPP" descr="This group includes generic informational events from PPP protocol."/>
    <value name="Info/Misc/PPTP" guiName="Info/Misc/PPTP" descr="This group includes generic informational events from PPTP protocol."/>
    <value name="Info/Misc/Printer" guiName="Info/Misc/Printer" descr="This group includes generic informational events on lpr protocol."/>
    <value name="Info/Misc/RDP" guiName="Info/Misc/RDP" descr="This group includes generic informational events from RDP protocol."/>
    <value name="Info/Misc/RPC" guiName="Info/Misc/RPC" descr="This group includes generic informational events on RPC services."/>
    <value name="Info/Misc/Router" guiName="Info/Misc/Router" descr="This group includes generic informational events from routers."/>
    <value name="Info/Misc/Routing" guiName="Info/Misc/Routing" descr="This group includes generic informational events from routing protocols: OSPF, BGP, RIP, HSRP etc."/>
    <value name="Info/Misc/SNMP" guiName="Info/Misc/SNMP" descr="This group includes generic informational events on SNMP protocol."/>
    <value name="Info/Misc/SOCKS" guiName="Info/Misc/SOCKS" descr="This group includes generic informational events from SOCKS proxy protocol."/>
    <value name="Info/Misc/SSL" guiName="Info/Misc/SSL" descr="This group includes generic informational events from SSL protocol."/>
    <value name="Info/Misc/SSLVPN" guiName="Info/Misc/SSLVPN" descr="This group includes generic informational events from SSL VPN servers."/>
    <value name="Info/Misc/Scanner" guiName="Info/Misc/Scanner" descr="This group includes generic informational events on Vulnerability scanners."/>
    <value name="Info/Misc/Switch" guiName="Info/Misc/Switch" descr="This group includes generic informational events from switches."/>
    <value name="Info/Misc/TFTP" guiName="Info/Misc/TFTP" descr="This group includes generic informational events on TFTP protocol"/>
    <value name="Info/Misc/VoIP" guiName="Info/Misc/VoIP" descr="This group includes generic informational events regarding Voice over IP."/>
    <value name="Info/Misc/Web" guiName="Info/Misc/Web" descr="This group includes generic informational events on HTTP protocol."/>
    <value name="Info/Mitigation/CS-MARS" guiName="Info/Mitigation/CS-MARS" descr="This group includes events indicating CS-MARS host mitigation successes and failures."/>
    <value name="Info/NewOutbreak/Download" guiName="Info/NewOutbreak/Download" descr="This group includes informational events from Cisco Incident Control Servers indicating successful download of OPACL, OPSig, Damage Clean Engine, Damage Clean Template, or Spyware pattern from Active Update server. These are for prevention of newly occurred virus or worm outbreak."/>
    <value name="Info/NewOutbreak/PreventionDeploy/Attempt" guiName="Info/NewOutbreak/PreventionDeploy/Attempt" descr="This group includes informational events from Cisco Incident Control Servers indicating starting of outbreak management task and preparation to deploy OPACL. These are for prevention of newly occurred virus or worm outbreak."/>
    <value name="Info/NewOutbreak/PreventionDeploy/Match" guiName="Info/NewOutbreak/PreventionDeploy/Match" descr="This group includes events from Cisco Incident Control Server, Cisco IOS and IPS devices that indicate matches to dynamically deployed ACL and signatures for prevention of newly discovered virus or worm outbreaks."/>
    <value name="Info/NewOutbreak/PreventionDeploy/Success" guiName="Info/NewOutbreak/PreventionDeploy/Success" descr="This group includes informational events from Cisco Incident Control Servers indicating successful deployments for prevention of newly occurred virus or worm outbreak."/>
    <value name="Info/ObjectAccess/Host" guiName="Info/ObjectAccess/Host" descr="This group includes events that indicate object (e.g. a file) access and operations on a host."/>
    <value name="Info/PrivilegedUse/Host" guiName="Info/PrivilegedUse/Host" descr="This group includes privileged operations on a host."/>
    <value name="Info/SecPostureStatus/Healthy" guiName="Info/SecPostureStatus/Healthy" descr="This group includes events that indicate that the Security Posture status of a host, as reported by the Cisco Network Admission Control system, is healthy. These hosts are security policy compliant and hence the software on these hosts does not need to be upgraded. "/>
    <value name="Info/SecPostureStatus/Healthy/NAD" guiName="Info/SecPostureStatus/Healthy/NAD" descr="This group includes events reported by the Network Access Device (NAD) component of Cisco Network Admission Control systemthat indicate that the Security Posture status of a host is healthy. These hosts are security policy compliant and hence the software on these hosts does not need to be upgraded. "/>
    <value name="Info/SecPostureStatus/NotHealthy" guiName="Info/SecPostureStatus/NotHealthy" descr="This group includes events that indicate that the Security Posture status of a host, as reported by the Cisco Network Admission Control system, is not healthy. These hosts are in either a CHECKUP, QUARANTINE, INFECTED or UNKNOWN state and the software on these hosts may need to be upgraded. "/>
    <value name="Info/SecPostureStatus/NotHealthy/NAD" guiName="Info/SecPostureStatus/NotHealthy/NAD" descr="This group includes events eported by the Network Access Device (NAD) component of Cisco Network Admission Control system that indicate that the Security Posture status of a host is not healthy. These hosts are in either a CHECKUP, QUARANTINE, INFECTED or UNKNOWN state."/>
    <value name="Info/SecPostureStatus/Transition" guiName="Info/SecPostureStatus/Transition" descr="This group includes events that indicate an end host in a TRANSITION security posture state. This state implies that the host is not running a Cisco Trust Agent (CTA) software and consequently, needs to be audited and assigned a proper security posture token by the Audit Server."/>
    <value name="Info/SecPostureStatus/Transition/NAD" guiName="Info/SecPostureStatus/Transition/NAD" descr="This group includes events reported by the Network Access Device (NAD) component of Cisco Network Admission Control system that indicates the Security Posture status of a host is in a TRANSITION state. This state implies that the host is not running a Cisco Trust Agent (CTA) software."/>
    <value name="Info/SecPostureValidation/All" guiName="Info/SecPostureValidation/All" descr="This group includes all the Cisco NAC based Security Posture validation events from network access devices and AAA server."/>
    <value name="Info/SecPostureValidation/Failure" guiName="Info/SecPostureValidation/Failure" descr="This group includes events that indicate that the Cisco Network Admission Control system failed to validate the security posture of a host. Such failures are likely caused by configuration errors in posture validation rule. "/>
    <value name="Info/SecPostureValidation/Failure/NAD" guiName="Info/SecPostureValidation/Failure/NAD" descr="This group includes events reported by network access devices such as switches, routers etc. that indicate that the Cisco Network Admission Control system failed to validate the security posture of a host. Such failures are likely due to configuration errors in posture validation rule. "/>
    <value name="Info/SecPostureValidation/NoCredentials" guiName="Info/SecPostureValidation/NoCredentials" descr="This group includes events that indicate that the Cisco Network Admission Control system failed to validate the security posture of a host since there is no Cisco Trust Agent running on that host. "/>
    <value name="Info/SecPostureValidation/StaticAuth" guiName="Info/SecPostureValidation/StaticAuth" descr="These group includes events that indicate that a network access device (NAD) permitted an end host by static configuration - the NAD did not validate the posture by commnicating to a AAA server."/>
    <value name="Info/SecPostureValidation/StatusQuery/Failed" guiName="Info/SecPostureValidation/StatusQuery/Failed" descr="This group indicates that the security posture status query from a network access device (NAD) to an end host failed. Status queries are done once the host security posture is validated and failed queries may indicate a security posture change in the end host."/>
    <value name="Info/SecPostureValidation/Success" guiName="Info/SecPostureValidation/Success" descr="This group includes events that indicate that the Cisco Network Admission Control system successfully validated the security posture of a host. "/>
    <value name="Info/SuccessfulLogin/AAA" guiName="Info/SuccessfulLogin/AAA" descr="This group includes events which indicate that an user has successfully logged on using AAA credentials. The logon could be for either logging into a device or for network access via VPN e.g. IPSec, PPTP, L2TP, SSL VPN etc."/>
    <value name="Info/SuccessfulLogin/DB" guiName="Info/SuccessfulLogin/DB" descr="This group includes events which indicate that an user has successfully logged into an database server."/>
    <value name="Info/SuccessfulLogin/FTP" guiName="Info/SuccessfulLogin/FTP" descr="This group includes events which indicate that an user has successfully logged into an FTP server."/>
    <value name="Info/SuccessfulLogin/IPSec" guiName="Info/SuccessfulLogin/IPSec" descr="This group includes events which indicate that an user has successfully logged on via IPSec VPN."/>
    <value name="Info/SuccessfulLogin/Mail" guiName="Info/SuccessfulLogin/Mail" descr="This group includes events which indicate that an user has successfully logged into a mail server."/>
    <value name="Info/SuccessfulLogin/Misc" guiName="Info/SuccessfulLogin/Misc" descr="This group includes events which indicate that an user has successfully logged on to miscellaneous applications (other than SSH, Telnet, POP, IMAP, SMTP, FTP, database servers) using application specific credentials."/>
    <value name="Info/SuccessfulLogin/NetBios" guiName="Info/SuccessfulLogin/NetBios" descr="This group includes events which indicate that an user has successfully accessed a network share."/>
    <value name="Info/SuccessfulLogin/PPP" guiName="Info/SuccessfulLogin/PPP" descr="This group includes events which indicate that an user has successfully logged onto the network for remote access via PPP based protocols such as L2TP, PPTP etc. "/>
    <value name="Info/SuccessfulLogin/SSLVPN" guiName="Info/SuccessfulLogin/SSLVPN" descr="This group includes events which indicate that an user has successfully logged onto the network for remote access via SSL VPN."/>
    <value name="Info/SuccessfulLogin/System/Non-root" guiName="Info/SuccessfulLogin/System/Non-root" descr="This group includes events which indicate that an user has successfully logged into a system as a normal user either using local console or via protocols such as Telnet, SSH etc. "/>
    <value name="Info/SuccessfulLogin/System/Root" guiName="Info/SuccessfulLogin/System/Root" descr="This group includes events which indicate that an user has successfully logged into a system as root (or system user) either using local console or via protocols such as Telnet, SSH etc. "/>
    <value name="Info/SuccessfulLogin/WinDomain" guiName="Info/SuccessfulLogin/WinDomain" descr="This group includes events which indicate that an user has successfully logged into an Windows domain. "/>
    <value name="Info/SuspiciousFileFound/Cleaned" guiName="Info/SuspiciousFileFound/Cleaned" descr="This group includes events that indicate that an Anti-virus software running on a host has found a Suspicious file and then cleaned (i.e. deleted, repaired or quarantined) the file.  "/>
    <value name="Info/SuspiciousFileFound/NotCleaned" guiName="Info/SuspiciousFileFound/NotCleaned" descr="This group includes events that indicate that an Anti-virus software running on a host has found a Suspicious file but could not clean (i.e. deleted, repaired or quarantined) the file.  "/>
    <value name="Info/SystemEvent/Host" guiName="Info/SystemEvent/Host" descr="This group includes miscellaneous system events on a host."/>
    <value name="Info/UncommonTraffic/Adult" guiName="Info/UncommonTraffic/Adult" descr="This group includes events which indicate that an user is surfing adult pornographic sites. These events are typically reported by Network IDS."/>
    <value name="Info/UncommonTraffic/Chat" guiName="Info/UncommonTraffic/Chat" descr="This group includes events which indicate that an user is invoking chat protocols such AOL Instant Messenger, Yahoo Messenger, MSN Messenger, IRC, Hotline etc. These events are typically reported by Network IDS."/>
    <value name="Info/UncommonTraffic/Chat/FileTransfer" guiName="Info/UncommonTraffic/Chat/FileTransfer" descr="This group includes events which indicate that files are being transferred over chat protocols such as AOL Instant Messenger, Yahoo Messenger, MSN Messenger, IRC. Such files often carry worms and viruses and may be inappropriate in corporate environments."/>
    <value name="Info/UncommonTraffic/Chat/Proxy" guiName="Info/UncommonTraffic/Chat/Proxy" descr="This group includes events which indicate that chat protocols such AOL Instant Messenger, Yahoo Messenger, MSN Messenger, IRC, Hotline etc. are being initiated via HTTP proxy methods. These events are typically reported by Network IDS."/>
    <value name="Info/UncommonTraffic/Gambling" guiName="Info/UncommonTraffic/Gambling" descr="This group includes events which indicate that an user is gambling sites. These events are typically reported by Network IDS."/>
    <value name="Info/UncommonTraffic/Games" guiName="Info/UncommonTraffic/Games" descr="This group includes events which indicate that an user is surfing gaming sites. These events are typically reported by Network IDS."/>
    <value name="Info/UncommonTraffic/ICMP" guiName="Info/UncommonTraffic/ICMP" descr="This group includes events which indicate that uncommon ICMP traffic such as Source Quench, Timestamp request/response, Information Request/Response, Address mask Request/response etc."/>
    <value name="Info/UncommonTraffic/JobSearch" guiName="Info/UncommonTraffic/JobSearch" descr="This group includes events which indicate that an user is surfing job search sites. These events are typically reported by Network IDS."/>
    <value name="Info/UncommonTraffic/Multimedia" guiName="Info/UncommonTraffic/Multimedia" descr="This group includes events which indicate that an user is invoking media players to connect to media sites on the Internet. These events are typically reported by Network IDS."/>
    <value name="Info/UncommonTraffic/Non-standardPort" guiName="Info/UncommonTraffic/Non-standardPort" descr="This group includes events which indicate that standard protocols such as SSH, IRC, SMTP are being run on non-standard ports that do not comply with IETF RFC specifications. "/>
    <value name="Info/UncommonTraffic/P2PFileShare" guiName="Info/UncommonTraffic/P2PFileShare" descr="This group includes events which indicate the use of person-to-person (P2P) file sharing protocols and applications such as KaZaa, Bearshare, Mutella, Limewire, Napster. Often inappropriate content are shared over these protocols and the files often carry worms and viruses."/>
    <value name="Info/UncommonTraffic/P2PFileShare/FileTransfer" guiName="Info/UncommonTraffic/P2PFileShare/FileTransfer" descr="This group includes events which indicate the actual transfer of files via person-to-person (P2P) file sharing protocols and applications such as KaZaa, Bearshare, Mutella, Limewire, Napster. Often inappropriate content or files containing worms/viruses are shared over these protocols."/>
    <value name="Info/UncommonTraffic/StockTrading" guiName="Info/UncommonTraffic/StockTrading" descr="This group includes events which indicate that an user is surfing stock trading sites. These events are typically reported by Network IDS."/>
    <value name="Info/UncommonTraffic/Suspicious" guiName="Info/UncommonTraffic/Suspicious" descr="This group includes events which indicate that legitimate but highly uncommon traffic, typically associated with experimental protocols."/>
    <value name="Info/UncommonTraffic/TCPIPOptions" guiName="Info/UncommonTraffic/TCPIPOptions" descr="This group includes events which indicate the use of rarely used TCP/IP header option fields such as Record Route, Timestamp etc. These events are typically reported by Network IDS."/>
    <value name="Info/VirusFound/Cleaned" guiName="Info/VirusFound/Cleaned" descr="This group includes events that indicate that an Anti-virus software running on a host has found a virus infected file and then cleaned (i.e. deleted, repaired or quarantined) the file.  "/>
    <value name="Info/VirusFound/NotCleaned" guiName="Info/VirusFound/NotCleaned" descr="This group includes events that indicate that an Anti-virus software running on a host has found a virus infected file but could not clean (i.e. deleted, repair or quarantine) the file. Such viruses must be immediately quarantined.  "/>
    <value name="Info/VulnerableHostFound" guiName="Info/VulnerableHostFound" descr="This group includes events which indicate that a vulnerable host is found. The host could be running old and vulnerable protocols such as SSHv1 or could have some other vulnerabilities as detected by Network IDS or vulnerability scanners."/>
    <value name="OperationalError/CICS" guiName="OperationalError/CICS" descr="This group includes events that indicate an operational error on a Cisco ICS server. Operational error includes internal software errors such as change account/device and generating reports, errors in verifying device connection status, errors in downloading updates etc."/>
    <value name="OperationalError/CICS/Deploy" guiName="OperationalError/CICS/Deploy" descr="This group includes events that indicate an operational error on a Cisco ICS server in deploying OPS components: OPACL, OPSig, DCE, DCT and Spyware pattern to devices such as routers, switches and IPS devices."/>
    <value name="OperationalError/CiscoCatOS" guiName="OperationalError/CiscoCatOS" descr="This group includes events that indicate an operational error on a Cisco catalyst switch running Catalyst operating system. Operational error includes mostly internal hardware and software errors, external host (e.g. AAA server) communication errors etc.  "/>
    <value name="OperationalError/CiscoIOS" guiName="OperationalError/CiscoIOS" descr="This group includes events that indicate an operational error on a Cisco router or switch running Cisco IOS. Operational error includes mostly internal hardware and software errors, external host (e.g. AAA server) communication errors etc. "/>
    <value name="OperationalError/CiscoNIDS" guiName="OperationalError/CiscoNIDS" descr="This group includes events that indicate an operational error on a appliance or switch/router module runing Cisco Network IDS module. Operational error includes mostly internal hardware and software errors, external host (e.g. AAA server) communication errors etc. "/>
    <value name="OperationalError/CiscoPix" guiName="OperationalError/CiscoPix" descr="This group includes events that indicate an operational error on a Cisco PIX firewall. Operational error includes mostly internal hardware and software errors, external host (e.g. AAA server) communication errors etc.  "/>
    <value name="OperationalError/CiscoVPNConc" guiName="OperationalError/CiscoVPNConc" descr="This group includes events that indicate an operational error on a Cisco VPN Concentrator appliance. Operational error includes mostly internal hardware and software errors, external host (e.g. AAA server) communication errors etc. "/>
    <value name="OperationalError/ExtremeSwitch" guiName="OperationalError/ExtremeSwitch" descr="This group includes events that indicate an operational error on a switch running Extreme Extremeware Operating system. Operational error includes mostly internal hardware and software errors, external host (e.g. AAA server) communication errors etc. "/>
    <value name="OperationalError/Host" guiName="OperationalError/Host" descr="This group includes events that indicate an operational error on host applications. Operational error includes mostly internal hardware and software errors, external host (e.g. AAA server) communication errors etc. "/>
    <value name="OperationalError/ISSSensor" guiName="OperationalError/ISSSensor" descr="This group includes events that indicate an operational error on a host or appliance running ISS real Secure Network/Host Sensor software. Operational error includes mostly internal hardware and software errors, external host (e.g. AAA server) communication errors etc. "/>
    <value name="OperationalError/NetScreenFirewall" guiName="OperationalError/NetScreenFirewall" descr="This group includes events that indicate an operational error on a Netscreen firewall appliance. Operational error includes mostly internal hardware and software errors, external host (e.g. AAA server) communication errors etc. "/>
    <value name="OperationalError/NetScreenIDP" guiName="OperationalError/NetScreenIDP" descr="This group includes events that indicate an operational error on a Netscreen IDP appliance. Operational error includes mostly internal hardware and software errors, external host (e.g. AAA server) communication errors etc. "/>
    <value name="OperationalError/NetworkDevice/Misc" guiName="OperationalError/NetworkDevice/Misc" descr="This group includes events that indicate an interface on a network device such as a firewall, router switch etc reporting excessive packets transmission and reception errors. "/>
    <value name="OperationalError/SymantecManHuntNIDS" guiName="OperationalError/SymantecManHuntNIDS" descr="This group includes events that indicate an operational error on a Symantec Manhunt Network IDS host. Operational error includes mostly internal hardware and software errors, external host (e.g. AAA server) communication errors etc. "/>
    <value name="OperationalStatusChange/Appl" guiName="OperationalStatusChange/Appl" descr="This group includes events that indicate a significant change in the operational status of an application - examples are application shutting down."/>
    <value name="OperationalStatusChange/CICS" guiName="OperationalStatusChange/CICS" descr="This group includes events that indicate a significant change in the operational status of a Cisco ICS server - examples are ICS service stopped."/>
    <value name="OperationalStatusChange/CiscoIOS" guiName="OperationalStatusChange/CiscoIOS" descr="This group includes events that indicate a significant change in the operational status of a switch or router running Cisco IOS - examples are interface down"/>
    <value name="OperationalStatusChange/CiscoPix" guiName="OperationalStatusChange/CiscoPix" descr="This group includes events that indicate a significant change in the operational status of a Cisco PIX firewall - examples are failover not working, interface down, appliance reloading etc. "/>
    <value name="OperationalStatusChange/CiscoVPNConc" guiName="OperationalStatusChange/CiscoVPNConc" descr="This group includes events that indicate a significant change in the operational status of a Cisco VPN concentrator - examples are interface down"/>
    <value name="OperationalStatusChange/Host" guiName="OperationalStatusChange/Host" descr="This group includes events that indicate a significant change in the operational status of a host - examples are host shutting down."/>
    <value name="OperationalStatusChange/IDS" guiName="OperationalStatusChange/IDS" descr="This group includes events that indicate a significant change in the operational status of an IDS sensor - examples are stopped reveiving traffic etc."/>
    <value name="OperationalStatusChange/Modbus" guiName="OperationalStatusChange/Modbus" descr="This group includes events that indicate a significant change in the operational status of a MODBUS server. MODBUS is the protocol of choice in a Supervisory Control and Data Acquisition (SCADA) communications network."/>
    <value name="OperationalStatusChange/NetscreenFirewall" guiName="OperationalStatusChange/NetscreenFirewall" descr="This group includes events that indicate a significant change in the operational status of a Netscreen firewall - examples are failover not working, interface down, appliance reloading etc. "/>
    <value name="Penetrate/All" guiName="Penetrate/All" descr="This group includes all events which indicate remote attempts to gain access to host or unauthorized information, or to attack a host, including buffer overflow, remote code execution, escalate to an unauthorized privilege, connect to backdoor, etc."/>
    <value name="Penetrate/ArpPoisoning" guiName="Penetrate/ArpPoisoning" descr="This group includes events that indicate attempts to poison the ARP cache and divert traffic."/>
    <value name="Penetrate/Backdoor/CommandShell" guiName="Penetrate/Backdoor/CommandShell" descr="This group includes events that indicate an attempt to logon or remotely execute various commands to a command shell in the clear - this indicates that a backdoor may be running on the destination."/>
    <value name="Penetrate/Backdoor/CovertChannel" guiName="Penetrate/Backdoor/CovertChannel" descr="This group includes events that indicate a covert channel; e.g. an HTTP tunnel to communicate non-HTTP protocols, an ICMP tunnel to communicate non ICMP protocols. "/>
    <value name="Penetrate/Backdoor/MiscApp" guiName="Penetrate/Backdoor/MiscApp" descr="This group includes events that indicate backdoors found in various applications. Such Backdoors enable unauthorized accesses to the creators of the applications. "/>
    <value name="Penetrate/Backdoor/RemoteControlApp/Connect" guiName="Penetrate/Backdoor/RemoteControlApp/Connect" descr="This group includes events that indicate a connection to a legitimate remote control program (e.g. VNC, pcAnywhere etc.) running on a host. "/>
    <value name="Penetrate/Backdoor/RemoteControlApp/Response" guiName="Penetrate/Backdoor/RemoteControlApp/Response" descr="This group includes events that indicate a response from a legitimate remote control program (e.g. VNC, pcAnywhere etc.) running on a host. "/>
    <value name="Penetrate/Backdoor/Rootkit/Connect" guiName="Penetrate/Backdoor/Rootkit/Connect" descr="This group includes events that indicate attempts to connect to a rootkit application on a host. A rootkit is a collection of trojaned OS utilities that can be left by an attacker on a successfully compromised host for future remote access. "/>
    <value name="Penetrate/Backdoor/Spyware/Request" guiName="Penetrate/Backdoor/Spyware/Request" descr="This group includes events that indicate an adware/spyware application on a host connecting back to pre-specified servers. These applications track a user's personal information and web surfing habits and send them back to third parties, without the user's authorization."/>
    <value name="Penetrate/Backdoor/Spyware/Response" guiName="Penetrate/Backdoor/Spyware/Response" descr="This group includes events that indicate an repsonse to a adware/spyware application on a host from pre-specified servers. These applications track a user's personal information and web surfing habits and send them back to third parties, without the user's authorization."/>
    <value name="Penetrate/Backdoor/Trojan/Connect" guiName="Penetrate/Backdoor/Trojan/Connect" descr="This group includes events that indicate an established connection to a backdoor application on a host. A backdoor program allows a remote client to open a connection to the affected system, capture keystrokes, issue commands and/or relay local information via email or IRC channels."/>
    <value name="Penetrate/Backdoor/Trojan/Response" guiName="Penetrate/Backdoor/Trojan/Response" descr="This group includes events that indicate a connection response from a backdoor application on a host. A backdoor program allows a remote client to open a connection to the affected system, capture keystrokes, issue commands and/or relay local information via email or IRC channels."/>
    <value name="Penetrate/Backdoor/Trojan/SYN" guiName="Penetrate/Backdoor/Trojan/SYN" descr="This group includes events that indicate TCP SYN connect attempts to a backdoor program on a host. A backdoor program allows a remote client to open a connection to the affected system, capture keystrokes, issue commands and/or relay local information via email or IRC channels."/>
    <value name="Penetrate/Backdoor/Trojan/SYN-ACK" guiName="Penetrate/Backdoor/Trojan/SYN-ACK" descr="This group includes events that indicate TCP SYN-ACK response from a backdoor application on a host. A backdoor program allows a remote client to open a connection to the affected system, capture keystrokes, issue commands and/or relay local information via email or IRC channels."/>
    <value name="Penetrate/BufferOverflow/DB" guiName="Penetrate/BufferOverflow/DB" descr="This group includes events that indicate buffer overflow attempts on a database server."/>
    <value name="Penetrate/BufferOverflow/DB/MSSQL" guiName="Penetrate/BufferOverflow/DB/MSSQL" descr="This group includes events that indicate buffer overflow attempts on the MS SQL database server."/>
    <value name="Penetrate/BufferOverflow/DB/Oracle" guiName="Penetrate/BufferOverflow/DB/Oracle" descr="This group includes events that indicate buffer overflow attempts on Oracle database server."/>
    <value name="Penetrate/BufferOverflow/DNS" guiName="Penetrate/BufferOverflow/DNS" descr="This group includes events that indicate buffer overflow attempts on a DNS server."/>
    <value name="Penetrate/BufferOverflow/FTP" guiName="Penetrate/BufferOverflow/FTP" descr="This group includes events that indicate buffer overflow attempts on an FTP server."/>
    <value name="Penetrate/BufferOverflow/Login" guiName="Penetrate/BufferOverflow/Login" descr="This group includes events that indicate buffer overflow attempts on login service such as Telnet, SSH, r-protocols. "/>
    <value name="Penetrate/BufferOverflow/Mail" guiName="Penetrate/BufferOverflow/Mail" descr="This group includes events that indicate buffer overflow attempts on a mail server running SMTP, POP, IMAP."/>
    <value name="Penetrate/BufferOverflow/Misc" guiName="Penetrate/BufferOverflow/Misc" descr="This group includes events that indicate buffer overflow attempts on miscellaneous protocols."/>
    <value name="Penetrate/BufferOverflow/RPC" guiName="Penetrate/BufferOverflow/RPC" descr="This group includes events that indicate buffer overflow attempts on an RPC service such as statd, cmsd, nfs, mountd, automountd, yppaswdd, rwalld etc."/>
    <value name="Penetrate/BufferOverflow/SNMP" guiName="Penetrate/BufferOverflow/SNMP" descr="This group includes events that indicate buffer overflow attempts on SNMP service."/>
    <value name="Penetrate/BufferOverflow/Web" guiName="Penetrate/BufferOverflow/Web" descr="This group includes events that indicate buffer overflow attempts on a web server."/>
    <value name="Penetrate/BufferOverflow/Web/Apache" guiName="Penetrate/BufferOverflow/Web/Apache" descr="This group includes events that indicate buffer overflow attempts on an Apache web server."/>
    <value name="Penetrate/BufferOverflow/Web/IIS" guiName="Penetrate/BufferOverflow/Web/IIS" descr="This group includes events that indicate buffer overflow attempts on a Microsoft IIS Web server."/>
    <value name="Penetrate/BufferOverflow/Web/iPlanet" guiName="Penetrate/BufferOverflow/Web/iPlanet" descr="This group includes events that indicate buffer overflow attempts on an SunOne iPlanet web server."/>
    <value name="Penetrate/ClientExploit/Mail" guiName="Penetrate/ClientExploit/Mail" descr="This group includes events that indicate attempts by an attacker masquerading as a mail server, to exploit various vulnerabilties of a mail client on a client workstation."/>
    <value name="Penetrate/ClientExploit/Misc" guiName="Penetrate/ClientExploit/Misc" descr="This group includes events that indicate attempts by an attacker to exploit various vulnerabilties on a client workstation. The vulnerable protocols can be client versions of DHCP, various Instant Messengers, DNS, FTP, P2P protocols and Windows OS. "/>
    <value name="Penetrate/ClientExploit/Web" guiName="Penetrate/ClientExploit/Web" descr="This group includes events that indicate attempts by an attacker masquerading as a web server, to exploit various vulnerabilties of a web browser on a client workstation."/>
    <value name="Penetrate/Evasion/FTP" guiName="Penetrate/Evasion/FTP" descr="This group includes events that indicate maliciously constructed packets within an FTP session - this might indicate attempts to bypass Network IDS systems. "/>
    <value name="Penetrate/Evasion/Generic" guiName="Penetrate/Evasion/Generic" descr="This group includes events that indicate maliciously constructed packets within a session for miscellaneous protocols such as SMB, SNMP, IDENT - this might indicate attempts to bypass Network IDS systems. "/>
    <value name="Penetrate/Evasion/Login" guiName="Penetrate/Evasion/Login" descr="This group includes events that indicate maliciously constructed packets within a login session involving telnet/ssh protocol - this might indicate attempts to bypass Network IDS systems. "/>
    <value name="Penetrate/Evasion/Mail" guiName="Penetrate/Evasion/Mail" descr="This group includes events that indicate maliciously constructed SMTP packets - this might indicate attempts to bypass mail filtering software. "/>
    <value name="Penetrate/Evasion/RPC" guiName="Penetrate/Evasion/RPC" descr="This group includes events that indicate maliciously constructed packets within an RPC session - this might indicate attempts to bypass Network IDS systems. "/>
    <value name="Penetrate/Evasion/TCPIP" guiName="Penetrate/Evasion/TCPIP" descr="This group includes events that indicate excessive or malicious packet fragmentation - this might indicate attempts to bypass IDS devices. "/>
    <value name="Penetrate/Evasion/Web" guiName="Penetrate/Evasion/Web" descr="This group includes events that indicate maliciously encoded HTTP payloads - this might indicate attempts to bypass IDS devices. "/>
    <value name="Penetrate/GuessPassword/AAA" guiName="Penetrate/GuessPassword/AAA" descr="This group includes events that indicate AAA server authentication and authorization failures. AAA servers are often used to offload Authentication and Authorization functionalities from network devices."/>
    <value name="Penetrate/GuessPassword/All" guiName="Penetrate/GuessPassword/All" descr="This group includes all authentication failure events which indicate unusual attempts to guess passwords of OS accounts, for accessing various services such as mail/FTP/database/web/VNC/CVS/windows domain/network share, for remote access such as PPP/P2TP/L2TP/IPSec/SSLVPN, etc."/>
    <value name="Penetrate/GuessPassword/DB" guiName="Penetrate/GuessPassword/DB" descr="This group includes authentication failure events which indicate unusual attempts to guess database server passwords."/>
    <value name="Penetrate/GuessPassword/DB/System" guiName="Penetrate/GuessPassword/DB/System" descr="This group includes authentication failure events for priviledged users such as sa, dvo and Administrator, which indicate unusual attempts to guess database server passwords, "/>
    <value name="Penetrate/GuessPassword/FTP" guiName="Penetrate/GuessPassword/FTP" descr="This group includes authentication failure events which indicate unusual attempts to guess FTP server passwords."/>
    <value name="Penetrate/GuessPassword/IPSec" guiName="Penetrate/GuessPassword/IPSec" descr="This group includes authentication failure events which indicate unusual attempts to guess IPSec passwords. IPSec is a protocol for secure site-to-site or remote access."/>
    <value name="Penetrate/GuessPassword/Mail" guiName="Penetrate/GuessPassword/Mail" descr="This group includes authentication failure events which indicate unusual attempts to guess mail server passwords."/>
    <value name="Penetrate/GuessPassword/Misc" guiName="Penetrate/GuessPassword/Misc" descr="This group includes miscellaneous authentication failure events which indicate unusual attempts to access various services such as SOCKS, VNC, NNTP, pcAnywhere, CVS etc.  "/>
    <value name="Penetrate/GuessPassword/NetworkShares" guiName="Penetrate/GuessPassword/NetworkShares" descr="This group includes authentication failure events which indicate unusual attempts to guess passwords for accessing network shares. Worms propagate by copying malicious executables into network shares."/>
    <value name="Penetrate/GuessPassword/RemoteAccess" guiName="Penetrate/GuessPassword/RemoteAccess" descr="This group includes authentication failure events which indicate unusual attempts to guess passwords for generic remote access protocols such as PPP, P2TP, L2TP etc."/>
    <value name="Penetrate/GuessPassword/SNMP" guiName="Penetrate/GuessPassword/SNMP" descr="This group includes authentication failure events which indicate unusual attempts to guess SNMP community strings. "/>
    <value name="Penetrate/GuessPassword/SSLVPN" guiName="Penetrate/GuessPassword/SSLVPN" descr="This group includes authentication failure events which indicate unusual attempts to guess SSLVPN passwords. SSLVPN is a protocol for secure remote access."/>
    <value name="Penetrate/GuessPassword/System/DisabledAcct" guiName="Penetrate/GuessPassword/System/DisabledAcct" descr="This group includes events that indicate failed logins to disabled, expired or locked accounts."/>
    <value name="Penetrate/GuessPassword/System/Non-root" guiName="Penetrate/GuessPassword/System/Non-root" descr="This group includes authentication failure events which indicate unusual attempts to guess user passwords (e.g. Telnet, SSH, R-protocol passwords) on a host."/>
    <value name="Penetrate/GuessPassword/System/RestrictedTime" guiName="Penetrate/GuessPassword/System/RestrictedTime" descr="This group includes events that indicate failed logins during restricted times."/>
    <value name="Penetrate/GuessPassword/System/Root" guiName="Penetrate/GuessPassword/System/Root" descr="This group includes authentication failure events which indicate unusual attempts to guess root or system passwords (e.g. Telnet, SSH, R-protocol passwords) on a host. "/>
    <value name="Penetrate/GuessPassword/WebServer" guiName="Penetrate/GuessPassword/WebServer" descr="This group includes authentication failure events which indicate unusual attempts to guess web server account passwords. "/>
    <value name="Penetrate/GuessPassword/WinDomain" guiName="Penetrate/GuessPassword/WinDomain" descr="This group includes authentication failure events which indicate unusual attempts to break into Windows Domain accounts. "/>
    <value name="Penetrate/HijackSession" guiName="Penetrate/HijackSession" descr="This group includes events that indicate attempts to hijack a TCP session."/>
    <value name="Penetrate/Nimdaworm" guiName="Penetrate/Nimdaworm" descr="This group includes events that indicate a Nimda worm."/>
    <value name="Penetrate/PrivilegeEscalation/ApplAdmin" guiName="Penetrate/PrivilegeEscalation/ApplAdmin" descr="This group includes events that indicate an attempt for a regular user to become a web application admin in a suspicious manner. "/>
    <value name="Penetrate/PrivilegeEscalation/Login" guiName="Penetrate/PrivilegeEscalation/Login" descr="This group includes events that indicate an attempt for a regular user to gain system user (or root user) privileges via login protocols (e.g. SSH, telnet etc.)"/>
    <value name="Penetrate/PrivilegeEscalation/Mail" guiName="Penetrate/PrivilegeEscalation/Mail" descr="This group includes events that indicate an attempt for a regular user to gain elevated privileges offered by Mail services: SMTP, POP, IMAP."/>
    <value name="Penetrate/PrivilegeEscalation/Misc" guiName="Penetrate/PrivilegeEscalation/Misc" descr="This group includes events that indicate an attempt for a regular user to gain elevated privileges by exploiting miscellaneous protocols."/>
    <value name="Penetrate/PrivilegeEscalation/RPC" guiName="Penetrate/PrivilegeEscalation/RPC" descr="This group includes events that indicate an attempt for a regular user to gain elevated privileges offered by RPC services."/>
    <value name="Penetrate/ProtocolAnomaly/DNS" guiName="Penetrate/ProtocolAnomaly/DNS" descr="This group includes events that indicate DNS IETF RFC specification violations."/>
    <value name="Penetrate/ProtocolAnomaly/FTP" guiName="Penetrate/ProtocolAnomaly/FTP" descr="This group includes events that indicate FTP IETF RFC specification violations."/>
    <value name="Penetrate/ProtocolAnomaly/Login" guiName="Penetrate/ProtocolAnomaly/Login" descr="This group includes events that indicate telnet/SSH/r-protocol IETF RFC specification violations."/>
    <value name="Penetrate/ProtocolAnomaly/Mail" guiName="Penetrate/ProtocolAnomaly/Mail" descr="This group includes events that indicate SMTP/POP/IMAP IETF RFC specification violations."/>
    <value name="Penetrate/ProtocolAnomaly/Misc" guiName="Penetrate/ProtocolAnomaly/Misc" descr="This group includes events that indicate violations of miscellaneous protocols such as IRC, SOCKS, LDAP etc."/>
    <value name="Penetrate/ProtocolAnomaly/Modbus" guiName="Penetrate/ProtocolAnomaly/Modbus" descr="This group includes events that indicate Modbus specification violations. MODBUS is the protocol of choice in a Supervisory Control and Data Acquisition (SCADA) communications network."/>
    <value name="Penetrate/ProtocolAnomaly/RPC" guiName="Penetrate/ProtocolAnomaly/RPC" descr="This group includes events that indicate IETF RFC specification violations of RPC services such as rstatd, mound, nfs, rwalld, rusers erc."/>
    <value name="Penetrate/ProtocolAnomaly/Routing" guiName="Penetrate/ProtocolAnomaly/Routing" descr="This group includes events that indicate IETF RFC specification violations of routing protocols such as BGP, OSPF, RIP."/>
    <value name="Penetrate/ProtocolAnomaly/SNMP" guiName="Penetrate/ProtocolAnomaly/SNMP" descr="This group includes events that indicate SNMP IETF RFC specification violations."/>
    <value name="Penetrate/ProtocolAnomaly/TCPIP" guiName="Penetrate/ProtocolAnomaly/TCPIP" descr="This group includes events that indicate TCP, UDP, IP headers that do not conform to IETF RFC specifications."/>
    <value name="Penetrate/ProtocolAnomaly/Web" guiName="Penetrate/ProtocolAnomaly/Web" descr="This group includes events that indicate HTTP IETF RFC specification violations."/>
    <value name="Penetrate/RemoteCmdExec/DB" guiName="Penetrate/RemoteCmdExec/DB" descr="This group includes events that indicate attempts to execute unauthorized commands on a database server by executing exploits other than buffer overflows. "/>
    <value name="Penetrate/RemoteCmdExec/FTP" guiName="Penetrate/RemoteCmdExec/FTP" descr="This group includes events that indicate attempts to execute unauthorized commands within an FTP session by executing exploits other than buffer overflows. "/>
    <value name="Penetrate/RemoteCmdExec/Mail" guiName="Penetrate/RemoteCmdExec/Mail" descr="This group includes events that indicate attempts to execute unauthorized commands within an SMTP/POP/IMAP session to a mail server by executing exploits other than buffer overflows. "/>
    <value name="Penetrate/RemoteCmdExec/Misc" guiName="Penetrate/RemoteCmdExec/Misc" descr="This group includes events that indicate attempts to execute unauthorized commands on a host running misclenneous services by executing exploits other than buffer overflows. "/>
    <value name="Penetrate/RemoteCmdExec/RPC" guiName="Penetrate/RemoteCmdExec/RPC" descr="This group includes events that indicate attempts to execute unauthorized commands on a host running RPC services by executing exploits other than buffer overflows. "/>
    <value name="Penetrate/RemoteCmdExec/SNMP" guiName="Penetrate/RemoteCmdExec/SNMP" descr="This group includes events that indicate attempts to execute unauthorized commands on a host running SNMP server by executing exploits other than buffer overflows. "/>
    <value name="Penetrate/RemoteCmdExec/Web" guiName="Penetrate/RemoteCmdExec/Web" descr="This group includes events that indicate attempts to execute unauthorized commands within an HTTP session by executing exploits other than buffer overflows."/>
    <value name="Penetrate/RemoteCmdExec/Web/Apache" guiName="Penetrate/RemoteCmdExec/Web/Apache" descr="This group includes events that indicate attempts to execute unauthorized commands within an HTTP session to a Apache Web server by executing exploits other than buffer overflows."/>
    <value name="Penetrate/RemoteCmdExec/Web/IIS" guiName="Penetrate/RemoteCmdExec/Web/IIS" descr="This group includes events that indicate attempts to execute unauthorized commands within an HTTP session to a Microsoft IIS Web server by executing exploits other than buffer overflows."/>
    <value name="Penetrate/ReplayAttack" guiName="Penetrate/ReplayAttack" descr="This group includes events that indicate replay attacks."/>
    <value name="Penetrate/RetrievePassword/All" guiName="Penetrate/RetrievePassword/All" descr="This group includes events which indicate unusual attempts to remotely retrieve system password files, SNMP community strings, FTP passwords, or miscellaneous application (mostly administrative) passwords. "/>
    <value name="Penetrate/RetrievePassword/Appl" guiName="Penetrate/RetrievePassword/Appl" descr="This group includes events which indicate unusual attempts to remotely retrieve miscellaneous application (mostly administrative) passwords. "/>
    <value name="Penetrate/RetrievePassword/FTP" guiName="Penetrate/RetrievePassword/FTP" descr="This group includes events which indicate unusual attempts to remotely retrieve FTP passwords. "/>
    <value name="Penetrate/RetrievePassword/SNMP" guiName="Penetrate/RetrievePassword/SNMP" descr="This group includes events which indicate unusual attempts to remotely retrieve SNMP community strings. "/>
    <value name="Penetrate/RetrievePassword/System" guiName="Penetrate/RetrievePassword/System" descr="This group includes events which indicate unusual attempts to remotely retrieve system password files or sensitive system files containing passwords."/>
    <value name="Penetrate/SQLInjection" guiName="Penetrate/SQLInjection" descr="This group includes events that indicate SQL Injection attempts on database servers. Inadequate processing of URL requests may allow users to execute unauthorized SQL commands by embedding them inside URLs. This can lead to modification of database tables. "/>
    <value name="Penetrate/Spam" guiName="Penetrate/Spam" descr="This group includes events that indicate e-mail spoofing techniques to hide e-mail sender identity - this may indicate SPAM attempts."/>
    <value name="Penetrate/SpoofIdentity/DNS" guiName="Penetrate/SpoofIdentity/DNS" descr="This group includes events that indicate spoofed DNS responses - this may cause traffic to be redirected to another address."/>
    <value name="Penetrate/SpoofIdentity/DNS/Success" guiName="Penetrate/SpoofIdentity/DNS/Success" descr="This group includes events that indicate successful spoofed DNS responses - this may cause traffic to be redirected to another address."/>
    <value name="Penetrate/SpoofIdentity/FTP" guiName="Penetrate/SpoofIdentity/FTP" descr="This group includes events that indicate spoofed FTP commands in order to bypass stateful firewall restrictions."/>
    <value name="Penetrate/SpoofIdentity/FTP/Success" guiName="Penetrate/SpoofIdentity/FTP/Success" descr="This group includes events that indicate successful spoofed FTP commands in order to bypass stateful firewall restrictions."/>
    <value name="Penetrate/SpoofIdentity/Mail" guiName="Penetrate/SpoofIdentity/Mail" descr="This group includes events that indicate e-mail spoofing techniques to hide e-mail sender identity - third party relaying, use of SMTP TURN command etc. "/>
    <value name="Penetrate/SpoofIdentity/Misc" guiName="Penetrate/SpoofIdentity/Misc" descr="This group includes events that indicate spoofing behavior in miscellaneous protocols such as Kerberos, SOCKS etc."/>
    <value name="Penetrate/SpoofIdentity/RPC" guiName="Penetrate/SpoofIdentity/RPC" descr="This group includes events that indicate proxied (spoofed) RPC requests in order to bypass authentication."/>
    <value name="Penetrate/SpoofIdentity/SNMP" guiName="Penetrate/SpoofIdentity/SNMP" descr="This group includes events that indicate attempts to hide the identity of SNMP sender to bypass authentication. "/>
    <value name="Penetrate/SpoofIdentity/TCPIP" guiName="Penetrate/SpoofIdentity/TCPIP" descr="This group includes events that indicate spoofed network addresses."/>
    <value name="Penetrate/SpoofIdentity/Web" guiName="Penetrate/SpoofIdentity/Web" descr="This group includes events that indicate attempts to hide the identity of web pages - including cache poisoning, IDN URL spoofing, etc."/>
    <value name="Penetrate/ViewFiles/DB" guiName="Penetrate/ViewFiles/DB" descr="This group includes events which indicate unusual attempts to view or determine the existence of files visible to a database service (such as MS SQL, Oracle, Sybase etc.) but not accessible to the typical user. This can lead to targetted attacks in the future. "/>
    <value name="Penetrate/ViewFiles/DirTraversal/FTP" guiName="Penetrate/ViewFiles/DirTraversal/FTP" descr="This group includes events which indicate FTP based directory traversal attacks; i.e. unusual attempts to view or determine the existence of files visible to the FTP orocess but not accessible to the regular user. This can lead to targetted attacks in the future. "/>
    <value name="Penetrate/ViewFiles/DirTraversal/Misc" guiName="Penetrate/ViewFiles/DirTraversal/Misc" descr="This group includes events which indicate miscellaneous protocol based directory traversal attacks; i.e. unusual attempts to view or determine the existence of files visible to those service but not accessible to the regular user. This can lead to targetted attacks in the future. "/>
    <value name="Penetrate/ViewFiles/DirTraversal/NetBios" guiName="Penetrate/ViewFiles/DirTraversal/NetBios" descr="This group includes events which indicate NetBios based directory traversal attacks; i.e. unusual attempts to view or determine the existence of files in a directory not accessible to the regularuser. This can lead to targetted attacks in the future. "/>
    <value name="Penetrate/ViewFiles/DirTraversal/NetMeeting" guiName="Penetrate/ViewFiles/DirTraversal/NetMeeting" descr="This group includes events which indicate Netmeeting based directory traversal attacks; i.e. unusual attempts to view or determine the existence of files visible to the NetMeeting service but not accessible to the regular user. This can lead to targetted attacks in the future. "/>
    <value name="Penetrate/ViewFiles/DirTraversal/RPC" guiName="Penetrate/ViewFiles/DirTraversal/RPC" descr="This group includes events which indicate RPC based directory traversal attacks; i.e. unusual attempts to view or determine the existence of files visible to the RPC service but not accessible to the regular user. This can lead to targetted attacks in the future. "/>
    <value name="Penetrate/ViewFiles/DirTraversal/Web" guiName="Penetrate/ViewFiles/DirTraversal/Web" descr="This group includes events which indicate HTTP based directory traversal attacks; i.e. unusual attempts to view or determine the existence of files visible to the web server but not accessible to the regular user. This can lead to targetted attacks in the future. "/>
    <value name="Penetrate/ViewFiles/HTTPSource" guiName="Penetrate/ViewFiles/HTTPSource" descr="This group includes events which indicate attempts to view the source code of scripts in web servers. Source code contain sensitive information such as passwords. This can lead to targetted attacks on the scripts or password based attacks. "/>
    <value name="Penetrate/ViewFiles/Sensitive" guiName="Penetrate/ViewFiles/Sensitive" descr="This group includes events which indicate unusual attempts to view sensitive system files on a web server via HTTP. This can lead to targetted attacks in the future. "/>
    <value name="Penetrate/ViewFiles/WebOrderInfo" guiName="Penetrate/ViewFiles/WebOrderInfo" descr="This group includes events which indicate unusual attempts to view customer sensitive files containing orders, credit card numbers in web servers. This can cause this sensitive information to be stolen and misused. "/>
    <value name="Persist/All" guiName="Persist/All" descr="This group includes all events that indicate activity on a host with authenticated access."/>
    <value name="Persist/CaptureSensitiveInfo" guiName="Persist/CaptureSensitiveInfo" descr="This group includes events that indicate an attempt to capture sensitive information from a host by installing special applications - examples are PWDUMP tool installation/activation, packet capturing tool activation etc. These typically require root access."/>
    <value name="Persist/ExecCommand/DB/Privileged/Failure" guiName="Persist/ExecCommand/DB/Privileged/Failure" descr="This group includes events that indicate failed privileged or system level database command execution (e.g. audit, grant, revoke etc.). These are reported by the database server audit logs."/>
    <value name="Persist/ExecCommand/DB/Privileged/Success" guiName="Persist/ExecCommand/DB/Privileged/Success" descr="This group includes events that indicate successful privileged or system level database command execution (e.g. audit, grant, revoke etc.). These are reported by the database server audit logs."/>
    <value name="Persist/ExecCommand/DB/Regular/Failure" guiName="Persist/ExecCommand/DB/Regular/Failure" descr="This group includes events that indicate failed regular database command execution (e.g. select, insert, update, delete, PL/SQL execute, Associate statistics views etc.). These are reported by the database server audit logs."/>
    <value name="Persist/ExecCommand/DB/Regular/Success" guiName="Persist/ExecCommand/DB/Regular/Success" descr="This group includes events that indicate successful regular database command execution (e.g. select, insert, update, delete, PL/SQL execute, Associate statistics views etc.). These are reported by the database server audit logs."/>
    <value name="Persist/ExecuteFile" guiName="Persist/ExecuteFile" descr="This group includes events that indicate attempts to execute a file on a host."/>
    <value name="Persist/HostCompromised/DB" guiName="Persist/HostCompromised/DB" descr="This group includes events that indicate a compromised database server."/>
    <value name="Persist/HostCompromised/DNS" guiName="Persist/HostCompromised/DNS" descr="This group includes events that indicate a compromised DNS server."/>
    <value name="Persist/HostCompromised/FTP" guiName="Persist/HostCompromised/FTP" descr="This group includes events that indicate a compromised FTP server."/>
    <value name="Persist/HostCompromised/Mail" guiName="Persist/HostCompromised/Mail" descr="This group includes events that indicate a compromised Mail server."/>
    <value name="Persist/HostCompromised/Misc" guiName="Persist/HostCompromised/Misc" descr="This group includes events that indicate a compromised server. "/>
    <value name="Persist/HostCompromised/RPC" guiName="Persist/HostCompromised/RPC" descr="This group includes events that indicate a compromised RPC service."/>
    <value name="Persist/HostCompromised/Web" guiName="Persist/HostCompromised/Web" descr="This group includes events that indicate a compromised web server."/>
    <value name="Persist/HostCompromised/Web/Failed" guiName="Persist/HostCompromised/Web/Failed" descr=" "/>
    <value name="Persist/InstallServices/All" guiName="Persist/InstallServices/All" descr="This group includes events that indicate an attempt to install various kinds of services on a host, including malicious, remote access, suspicious, auto run service, etc. These events are reported by Host IDS. Worms typically install such services on a compromised host."/>
    <value name="Persist/InstallServices/Autorun" guiName="Persist/InstallServices/Autorun" descr="This group includes events that indicate an attempt to install auto run services on a host. These services would be run automatically after next reboot. Worms typically install malicious auto run services on a compromised host."/>
    <value name="Persist/InstallServices/Malicious" guiName="Persist/InstallServices/Malicious" descr="This group includes events that indicate an attempt to install malicious trojans (e.g. Asylum, NetBus etc.)on a host. These events are reported by Host IDS. Worms typically install such services on a compromised host."/>
    <value name="Persist/InstallServices/RemoteAccess" guiName="Persist/InstallServices/RemoteAccess" descr="This group includes events that indicate an attempt to install remote control applications on a host. These events are reported by Host IDS. Worms typically install such services on a compromised host."/>
    <value name="Persist/InstallServices/Suspicious" guiName="Persist/InstallServices/Suspicious" descr="This group includes events that indicate an attempt to install services on a host. These are generally suspicious and are reported by Host IDS. Worms typically install malicious services on a compromised host."/>
    <value name="Persist/ModifyHost/All" guiName="Persist/ModifyHost/All" descr="This group includes all events that indicate attempts to modify configuration/files on a host, including using SNMP, modifying files, registry, user accounts, group accounts, security policy, service settings, logs, etc."/>
    <value name="Persist/ModifyHost/CICS" guiName="Persist/ModifyHost/CICS" descr="This group includes events that indicate attempts to change configuration on Cisco ICS servers, such as addition/change/removal of accounts and devices."/>
    <value name="Persist/ModifyHost/DB/DBObject/Failure" guiName="Persist/ModifyHost/DB/DBObject/Failure" descr="This group includes events that indicate failed database object (e.g. tables, views, indexes, clusters etc.) modification. These are reported by the database server audit logs."/>
    <value name="Persist/ModifyHost/DB/DBObject/Success" guiName="Persist/ModifyHost/DB/DBObject/Success" descr="This group includes events that indicate successful database object (tables, views, indexes, clusters etc.). These are reported by the database server audit logs."/>
    <value name="Persist/ModifyHost/DB/UserGroup/Failure" guiName="Persist/ModifyHost/DB/UserGroup/Failure" descr="This group includes events that indicate failed database server user group modification attempts. These are reported by the database server audit logs."/>
    <value name="Persist/ModifyHost/DB/UserGroup/Success" guiName="Persist/ModifyHost/DB/UserGroup/Success" descr="This group includes events that indicate successful database server user group modification. These are reported by the database server audit logs."/>
    <value name="Persist/ModifyHost/Files" guiName="Persist/ModifyHost/Files" descr="This group includes events that indicate attempts to modify files on a host."/>
    <value name="Persist/ModifyHost/Log" guiName="Persist/ModifyHost/Log" descr="This group includes events that indicate attempts to modify logs on hosts. Attackers may attempt to destroy or modify logs in order to hide activity."/>
    <value name="Persist/ModifyHost/Misc" guiName="Persist/ModifyHost/Misc" descr="This group includes events that indicate miscellaneous aspects of host modification. "/>
    <value name="Persist/ModifyHost/Modbus" guiName="Persist/ModifyHost/Modbus" descr="This group includes events that indicate attempts to modify Modbus control servers. Modbus protocol has become a defacto standard in industrial control communications and is the protocol of choice in a Supervisory Control and Data Acquisition (SCADA) communications network. "/>
    <value name="Persist/ModifyHost/Registry" guiName="Persist/ModifyHost/Registry" descr="This group includes events that indicate attempts to modify registry entries on a windows host."/>
    <value name="Persist/ModifyHost/SNMP" guiName="Persist/ModifyHost/SNMP" descr="This group includes events that indicate attempts to modify configuration via SNMP SET commands."/>
    <value name="Persist/ModifyHost/SecurityPolicy" guiName="Persist/ModifyHost/SecurityPolicy" descr="This group includes events that indicate attempts to modify security policies (e.g. user rights, audit policies etc.) on workstations and servers."/>
    <value name="Persist/ModifyHost/SecurityPolicy/Weaken" guiName="Persist/ModifyHost/SecurityPolicy/Weaken" descr="This group includes events that indicate attempts to weaken security policies on workstations and servers. Such examples include disabling strong password enforcement, enabling IE ActiveX scripting etc. "/>
    <value name="Persist/ModifyHost/ServiceSettings" guiName="Persist/ModifyHost/ServiceSettings" descr="This group includes events that indicate attempts to modify the service settings on workstations and servers. "/>
    <value name="Persist/ModifyHost/UserGroup" guiName="Persist/ModifyHost/UserGroup" descr="This group includes events that indicate attempts to modify user group settings on workstations and servers."/>
    <value name="Persist/ModifyNetworkConfig" guiName="Persist/ModifyNetworkConfig" descr="This group includes events that indicate attempts to modify configuration of network devices such as firewalls, routers, switches etc."/>
    <value name="Persist/PrivilegeEscalation/LocalBufferOverflow" guiName="Persist/PrivilegeEscalation/LocalBufferOverflow" descr="This group includes events that indicate an attempt to cause a local buffer overflow on a host - this events require access to the host and can provide root access."/>
    <value name="Persist/PrivilegeEscalation/Misc" guiName="Persist/PrivilegeEscalation/Misc" descr="This group includes events that indicate an attempt to escalate privileges after having regular access. The mechanisms would include exploiting vulnerabilities of known applications that run with system privileges."/>
    <value name="Persist/PrivilegeEscalation/Symlink" guiName="Persist/PrivilegeEscalation/Symlink" descr="This group includes events that indicate an attempt to gain system privileges by symbolically linking to special files - this events require access to the host."/>
    <value name="Persist/SuspiciousActivity" guiName="Persist/SuspiciousActivity" descr="This group includes events that indicate suspicious activity on a host."/>
    <value name="Probe/ClientInfo/Login" guiName="Probe/ClientInfo/Login" descr="This group includes events which indicate attempts to gather information (e.g. version, setup etc.) about clients to the login  services (e.g. Telnet, SSH etc.) on a host. This can lead to targetted attacks on those protocols or password guessing attacks."/>
    <value name="Probe/Firewall" guiName="Probe/Firewall" descr="This group includes events which indicate an attempt to discover firewall rules. The knowledge of firewall rules may enable an attacker to discover exposed servers and services and launch targeted attacks. "/>
    <value name="Probe/FromScanner" guiName="Probe/FromScanner" descr="This group includes events which detect that a scanner application (e.g. Nessus, E-eye Retina, ISS Scanner etc.) is being used to map hosts in a network and discover vulnerabilities. "/>
    <value name="Probe/Host/Config" guiName="Probe/Host/Config" descr="This group includes events which indicate attempts to gather information about the generic configuration of a host: its operating system, environment variables, hardware set up etc. This could lead to targetted attacks. "/>
    <value name="Probe/Host/NetworkShare" guiName="Probe/Host/NetworkShare" descr="This group includes events which indicate attempts to gather information about remotely accessible shares. Worms propagate by first connecting to and then dumping malicious files on remotely accesible shares.  "/>
    <value name="Probe/Host/Stealth" guiName="Probe/Host/Stealth" descr="This group includes events which indicate stealthy attempts to determine the presence of a host. Stealth operation includes unnecessarily fragmenting packets and setting unusual TCP/IP header flag combinations to see how the hosts respond."/>
    <value name="Probe/Host/UserName" guiName="Probe/Host/UserName" descr="This group includes events which indicate attempts to gather information about user accounts on a host. This can lead to password guessing attacks on that host."/>
    <value name="Probe/Host/WinRegistry" guiName="Probe/Host/WinRegistry" descr="This group includes events which indicate attempts to gather information about the host and various applications running on a windows host by reading the windows registry on the host. This could lead to targetted attacks. "/>
    <value name="Probe/HostInfo/All" guiName="Probe/HostInfo/All" descr="This group includes all events which detect that an attacker is probing information regarding hosts, including using sweep to find live hosts, scanning specifie ports, scanning hosts in promiscuous state, probing firewall rules to find exposed hosts, etc."/>
    <value name="Probe/HostSweep/Non-stealth" guiName="Probe/HostSweep/Non-stealth" descr="This group includes events which detect that an attacker is scanning the hosts in a network in a non-stealth mode looking for live hosts. Non-Stealth operation includes simple ICMP based ping packets. "/>
    <value name="Probe/HostSweep/Stealth" guiName="Probe/HostSweep/Stealth" descr="This group includes events which detect that an attacker is scanning the hosts in a network in a stealth mode looking for live hosts. Stealth operation includes unnecessarily fragmenting packets and setting unusual TCP/IP header flag combinations to see how the hosts respond."/>
    <value name="Probe/NetworkInfo" guiName="Probe/NetworkInfo" descr="This group includes events which indicate an attempt to discover network devices, network device configurations, DNS zone transfers etc."/>
    <value name="Probe/PortSweep/Non-stealth" guiName="Probe/PortSweep/Non-stealth" descr="This group includes events which detect that an attacker is scanning the ports of a particular host in a non-stealth mode looking for open services. Non-Stealth operation includes simple ICMP based ping packets. "/>
    <value name="Probe/PortSweep/Stealth" guiName="Probe/PortSweep/Stealth" descr="This group includes events which detect that an attacker is scanning the ports of a particular host in a stealth mode looking for open services. Stealth operation includes unnecessarily fragmenting packets and setting unusual TCP/IP header flag combinations to see how the hosts respond."/>
    <value name="Probe/PromiscuousHost" guiName="Probe/PromiscuousHost" descr="This group includes events which indicate an attempt to locate hosts running in promiscuous mode. Hosts running in promiscuous mode are either IDS systems or have access to privilege information and hence are prime targets for attackers."/>
    <value name="Probe/ServerInfo/DB" guiName="Probe/ServerInfo/DB" descr="This group includes events which indicate attempts to gather information (e.g. version, setup, users) about the database services e.g. MS SQL, Otacle, Sybase, MySQL running on a host. This can lead to targetted database specific attacks or password attacks for database access."/>
    <value name="Probe/ServerInfo/DB/Response" guiName="Probe/ServerInfo/DB/Response" descr="This group includes events which indicate responses to attempts to gather information (e.g. version, setup, users) about the database services e.g. MS SQL, Otacle, Sybase, MySQL running on a host. This can lead to targetted database specific attacks or password attacks for database access."/>
    <value name="Probe/ServerInfo/DNS" guiName="Probe/ServerInfo/DNS" descr="This group includes events which indicate attempts to gather information (e.g. the version, author, setup etc.) about the DNS service on a host. This can lead to targetted DNS based attacks on that host."/>
    <value name="Probe/ServerInfo/FTP" guiName="Probe/ServerInfo/FTP" descr="This group includes events which indicate attempts to gather information (e.g. version, setup, commands exposed) about the FTP service running on a host. This can lead to targetted attacks on the FTP protocol or password attacks for FTP access."/>
    <value name="Probe/ServerInfo/Login" guiName="Probe/ServerInfo/Login" descr="This group includes events which indicate attempts to gather information (e.g. version, setup etc.) about the login  services (e.g. Telnet, SSH etc.) on a host. This can lead to targetted attacks on those protocols or password guessing attacks."/>
    <value name="Probe/ServerInfo/Mail" guiName="Probe/ServerInfo/Mail" descr="This group includes events which indicate attempts to gather information (e.g. version, setup, commands supported etc.) about the mail services: SMTP, POP, IMAP. This can lead to targetted attacks on those protocols."/>
    <value name="Probe/ServerInfo/Misc" guiName="Probe/ServerInfo/Misc" descr="This group includes events which indicate attempts to gather information about miscellaneous services (e.g. finger, Bugzilla, XDMCP etc.) on a host."/>
    <value name="Probe/ServerInfo/Modbus" guiName="Probe/ServerInfo/Modbus" descr="This group includes events which indicate attempts to gather information about ModBus service on a host. This can lead to targetted Modbus specific attacks. MODBUS is the protocol of choice in a Supervisory Control and Data Acquisition (SCADA) communications network."/>
    <value name="Probe/ServerInfo/RPC" guiName="Probe/ServerInfo/RPC" descr="This group includes events which indicate attempts to gather information (e.g. version, setup, dynamic ports for specific services) about the RPC service running on a host. This can lead to targetted attacks on RPC based services such as RSTATD, MOUNTD etc."/>
    <value name="Probe/ServerInfo/Web" guiName="Probe/ServerInfo/Web" descr="This group includes events which indicate attempts to gather information (e.g. version, setup, users, existence of specific scripts) about the web server running on a host. This can lead to targetted web server specific attacks."/>
    <value name="Probe/SpecificPorts" guiName="Probe/SpecificPorts" descr="This group includes events which detect that an attacker is looking for all hosts that are running a particular service, e.g. TCP port 445. This may be a precursor to exploiting a very specific vulnerability."/>
    <value name="Propagate/CopyFiles" guiName="Propagate/CopyFiles" descr="This group includes events that indicate an attempt to copy files over the network. While this is a typical property of worms, the files as captured by these events are not necessarily malicious. "/>
    <value name="Propagate/Worm" guiName="Propagate/Worm" descr="This group includes events that indicate a worm propagation via various protocols such as e-mail, NetBios shares, P2P, FTP, TFTP. The source is in these events is likely infected."/>
    <value name="SANSTop20" guiName="SANSTop20" descr="This group includes the Top 20 Internet Security vulnerabilities as of version 5.0 October 2004 compiled by the SANS Institite. These can be found in http://www.sans.org/top20/"/>
    <value name="SwitchPolicyViolation/PortSecurity" guiName="SwitchPolicyViolation/PortSecurity" descr="This group includes events that indicate switch port policy violations on a network switch. Switch port policies include acceptable per port MAC, IP etc. "/>
  </tEnum>
  <tEnum typeName="Enum49081" min="1" max="1" default="to-service">
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
  </tEnum>
  <tEnum typeName="Enum49084" min="0" max="10" default="produce-alert">
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="request-block-host" guiName="Request Block Host" descr="Request blocking on the attacking host by configured devices"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
  </tEnum>
  <tEnum typeName="Enum49121" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum49124" min="0" max="14" default="produce-alert">
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
    <value name="deny-connection-inline" guiName="Deny Connection Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the TCP Flow."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="request-block-connection" guiName="Request Block Connection" descr="request NAC to shun this connection"/>
    <value name="request-block-host" guiName="Request Block Host" descr="request NAC to shun this attacker host"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
    <value name="reset-tcp-connection" guiName="Reset TCP Connection" descr="send TCP RESETS to hijack and terminate the TCP Flow."/>
  </tEnum>
  <tEnum typeName="Enum49162" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tEnum typeName="Enum49165" min="0" max="12" default="produce-alert">
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="request-block-connection" guiName="Request Block Connection" descr="request NAC to shun this connection"/>
    <value name="request-block-host" guiName="Request Block Host" descr="Request blocking on the attacking host by configured devices"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
  </tEnum>
  <tEnum typeName="Enum49202" min="0" max="14" default="produce-alert">
    <value name="deny-attacker-inline" guiName="Deny Attacker Inline" descr="INLINE ONLY: do not transmit this packet and future packets from the attacker address for a specified period of time."/>
    <value name="deny-attacker-service-pair-inline" guiName="Deny Attacker Service Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker address victim port pair for a specified period of time."/>
    <value name="deny-attacker-victim-pair-inline" guiName="Deny Attacker Victim Pair Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the attacker/victim address pair for a specified period of time."/>
    <value name="deny-connection-inline" guiName="Deny Connection Inline" descr="INLINE ONLY: do not transmit this packet and future packets on the TCP Flow."/>
    <value name="deny-packet-inline" guiName="Deny Packet Inline" descr="INLINE ONLY: do not transmit this packet"/>
    <value name="log-attacker-packets" guiName="Log Attacker Packets" descr="start IPLOGGING packets containing the attacker address."/>
    <value name="log-pair-packets" guiName="Log Pair Packets" descr="start IPLOGGING packets containing the attacker-victim address pair."/>
    <value name="log-victim-packets" guiName="Log Victim Packets" descr="start IPLOGGING packets containing the victim address."/>
    <value name="produce-alert" guiName="Produce Alert" descr="write evIdsAlert to Event Store."/>
    <value name="produce-verbose-alert" guiName="Produce Verbose Alert" descr="include an encoded dump (possibly truncated) of the offending packet in the evIdsAlert."/>
    <value name="request-block-connection" guiName="Request Block Connection" descr="request NAC to shun this connection"/>
    <value name="request-block-host" guiName="Request Block Host" descr="request NAC to shun this attacker host"/>
    <value name="request-snmp-trap" guiName="Request SNMP Trap" descr="send request to Notification App to perform Snmp action."/>
    <value name="reset-tcp-connection" guiName="Reset TCP Connection" descr="send TCP RESETS to hijack and terminate the TCP Flow."/>
  </tEnum>
  <tEnum typeName="Enum49217" min="1" max="1" default="to-service">
    <value name="from-service" guiName="From Service" descr="Traffic from service port destined to client port"/>
    <value name="to-service" guiName="To Service" descr="Traffic from client port destined to service port"/>
  </tEnum>
  <tList typeName="List48520"   valType="Struct48521" valName="component-group" min="1" max="32" valGuiName="Component Group"/>
  <tList typeName="List48130"   valType="Struct48128" valName="magic-number" min="1" max="8" valGuiName="Magic Number"/>
  <tList typeName="List48622"   valType="Struct48613" valName="magic-number-struct" valGuiName="Magic Number"/>
  <tList typeName="List47764"   valType="Struct47613" valName="recognized-content-type" valGuiName="Recognized Content Type"/>
  <tList typeName="List47731"   valType="Struct47558" valName="recognized-request-method" valGuiName="Recognized Request Method"/>
  <tList typeName="List47766"   valType="Struct47557" valName="recognized-transfer-encoding" valGuiName="Recognized Transfer Encoding"/>
  <tList typeName="List48615"   valType="Struct48616" valName="regex-component" min="1" max="16" valGuiName="Regular Expression"/>
  <tList typeName="List48144"   valType="Struct48145" valName="regex-definition" min="0" max="8" valGuiName="Regex Definition"/>
  <tMap typeName="Map48392" valType="Struct48391" valName="signature-definition" valGuiName="Signature Definition">
    <key name="sig-id" guiName="Signature ID" type="Integer1000-65000"/>
    <key name="subsig-id" guiName="SubSignature ID" type="Integer0-255"/>
  </tMap>
  <tSet typeName="Set48643" protected="true"  min="0" max="65535" >
    <key name="obsoleted-sig-id" guiName="Obsoleted Signature ID" type="Integer1000-65000" descr="Obsoleted Signature ID"/>
    <key name="obsoleted-subsig-id" guiName="Obsoleted SubSignature ID" type="Integer0-255" descr="Obsoleted Sub Signature ID"/>
  </tSet>
  <tSet typeName="Set48151" min="2" max="6" >
    <key name="tcp-flags" guiName="TCP Flags" type="Enum47780" descr="TCP Flags to match when masked by Mask."/>
  </tSet>
  <tStruct typeName="Struct48529" >
  </tStruct>
  <tStruct typeName="Struct47995" >
  </tStruct>
  <tStruct typeName="Struct48396" >
    <member name="summary-mode" guiName="Summary Mode" default="summarize" type="Union47863" descr="Mode of summarization"/>
  </tStruct>
  <tStruct typeName="Struct47922" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum47867" descr="What action(s) to perform when alert is triggered"/>
    <member name="signature-type" guiName="Signature Type" type="Union48533" descr="Type of signature"/>
  </tStruct>
  <tStruct typeName="Struct48152" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum47979" descr="What action(s) to perform when alert is triggered"/>
    <member name="signature-type" guiName="Signature Type" default="msg-body-pattern" type="Union48153" descr="Type of signature desired."/>
  </tStruct>
  <tStruct typeName="Struct48183" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48028" descr="What action(s) to perform when alert is triggered"/>
    <member name="specify-mac-flip" guiName="Specify Mac Flip Times" default="no" type="Union48030" descr="mac-flip is an optional parameter. Use specify-mac-flip yes to enable mac-flip for use."/>
    <member name="specify-type-of-arp-sig" guiName="Specify Type of ARP Sig" default="no" type="Union48012" descr="type-of-arp-sig is an optional parameter. Use specify-type-of-arp-sig yes to enable type-of-arp-sig for use."/>
    <member name="specify-request-inbalance" guiName="Specify Request Inbalance" default="no" type="Union48011" descr="request-inbalance is an optional parameter. Use specify-request-inbalance yes to enable request-inbalance for use."/>
    <member name="specify-arp-operation" guiName="Specify ARP Operation" default="no" type="Union47802" descr="arp-operation is an optional parameter. Use specify-arp-operation yes to enable arp-operation for use."/>
    <member name="storage-key" guiName="Storage Key" type="Enum47649" descr="Type of Address Key used to store persistent data."/>
  </tStruct>
  <tStruct typeName="Struct48433" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="fragment-status" guiName="Fragment Status" default="any" type="Enum47676" descr="Specify whether fragments are wanted or not."/>
    <member name="specify-l4-protocol" guiName="Specify Layer 4 Protocol" default="no" type="Union48077" descr="l4-protocol is an optional parameter. Use specify-l4-protocol yes to enable l4-protocol for use."/>
    <member name="specify-ip-payload-length" guiName="Specify IP Payload Length" default="no" type="Union48446" descr="ip-payload-length is an optional parameter. Use specify-ip-payload-length yes to enable ip-payload-length for use."/>
    <member name="specify-ip-header-length" guiName="Specify IP Header Length" default="no" type="Union48102" descr="ip-header-length is an optional parameter. Use specify-ip-header-length yes to enable ip-header-length for use."/>
    <member name="specify-ip-tos" guiName="Specify IP Type of Service" default="no" type="Union48099" descr="ip-tos is an optional parameter. Use specify-ip-tos yes to enable ip-tos for use."/>
    <member name="specify-ip-ttl" guiName="Specify IP Time-to-Live" default="no" type="Union48096" descr="ip-ttl is an optional parameter. Use specify-ip-ttl yes to enable ip-ttl for use."/>
    <member name="specify-ip-version" guiName="Specify IP Version" default="no" type="Union48093" descr="ip-version is an optional parameter. Use specify-ip-version yes to enable ip-version for use."/>
    <member name="specify-ip-id" guiName="Specify IP Identifier" default="no" type="Union48088" descr="ip-id is an optional parameter. Use specify-ip-id yes to enable ip-id for use."/>
    <member name="specify-ip-total-length" guiName="Specify IP Total Length" default="no" type="Union48085" descr="ip-total-length is an optional parameter. Use specify-ip-total-length yes to enable ip-total-length for use."/>
    <member name="specify-ip-option-inspection" guiName="Specify IP Option Inspection" default="no" type="Union48082" descr="ip-option-inspection is an optional parameter. Use specify-ip-option-inspection yes to enable ip-option-inspection for use."/>
    <member name="specify-ip-addr-options" guiName="Specify IP Addr Options" default="no" type="Union47828" descr="ip-addr-options is an optional parameter. Use specify-ip-addr-options yes to enable ip-addr-options for use."/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct48710" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48711" descr=" "/>
  </tStruct>
  <tStruct typeName="Struct48528" >
    <member name="unique-victim-ports" guiName="Unique Victim Ports" default="1" type="Integer1-2561" descr="Number of unique victims ports required per META signature"/>
  </tStruct>
  <tStruct typeName="Struct48526" >
    <member name="unique-victims" guiName="Unique Victims" default="1" type="Integer1-2561" descr="Number of unique victims required per META signature"/>
  </tStruct>
  <tStruct typeName="Struct47824" >
    <member name="source-ports" guiName="Source Ports" type="IntegerRange0-65535am" descr="Source ports used in inspection"/>
    <member name="dest-ports" guiName="Dest Ports" type="IntegerRange0-65535am" descr="Destination ports"/>
  </tStruct>
  <tStruct typeName="Struct48293" >
    <member name="brute-force-count" guiName="Brute Force Count" type="Integer0-65535" descr="SNMP Community Name Brute Force Counter"/>
  </tStruct>
  <tStruct typeName="Struct47869" >
  </tStruct>
  <tStruct typeName="Struct47530" >
    <member name="state-name" guiName="State Name" type="Enum48317" descr="Name of state required before producing an alert"/>
  </tStruct>
  <tStruct typeName="Struct48521" >
    <member name="component-sig-id" guiName="Component Sig ID" type="Integer1000-65000" descr="Sig Id of signature to match this component on."/>
    <member name="component-subsig-id" guiName="Component SubSig ID" default="0" type="Integer0-1280" descr="SubSig Id of signature to match this component on."/>
    <member name="component-count" guiName="Component Count" default="1" type="Integer1-2561" descr="Number of times component must fire before this component is satisfied"/>
  </tStruct>
  <tStruct typeName="Struct47758" >
    <member name="content-type-verify" guiName="Content Type Verify" type="Bool" descr="content-type-verify"/>
    <member name="magic-number-series" guiName="Magic Number Series" type="List48622" descr="magic-number-series"/>
  </tStruct>
  <tStruct typeName="Struct47527" >
    <member name="specify-service-ports" guiName="Specify Service Ports" default="no" type="Union47632" descr="service-ports is an optional parameter. Use specify-service-ports yes to enable service-ports for use."/>
    <member name="specify-tcp-max-mss" guiName="Specify TCP Max MSS" default="no" type="Union47612" descr="tcp-max-mss is an optional parameter. Use specify-tcp-max-mss yes to enable tcp-max-mss for use."/>
    <member name="specify-tcp-min-mss" guiName="Specify TCP Min MSS" default="no" type="Union47609" descr="tcp-min-mss is an optional parameter. Use specify-tcp-min-mss yes to enable tcp-min-mss for use."/>
    <member name="specify-tcp-option-number" guiName="Specify TCP Option Number" default="no" type="Union47606" descr="tcp-option-number is an optional parameter. Use specify-tcp-option-number yes to enable tcp-option-number for use."/>
    <member name="specify-tcp-max-queue" guiName="Specify TCP Max Queue" default="no" type="Union47603" descr="tcp-max-queue is an optional parameter. Use specify-tcp-max-queue yes to enable tcp-max-queue for use."/>
    <member name="specify-tcp-closed-timeout" guiName="Specify TCP Closed Timeout" default="no" type="Union47600" descr="tcp-closed-timeout is an optional parameter. Use specify-tcp-closed-timeout yes to enable tcp-closed-timeout for use."/>
    <member name="specify-tcp-embryonic-timeout" guiName="Specify TCP Embryonic Timeout" default="no" type="Union47597" descr="tcp-embryonic-timeout is an optional parameter. Use specify-tcp-embryonic-timeout yes to enable tcp-embryonic-timeout for use."/>
    <member name="specify-tcp-idle-timeout" guiName="Specify TCP Idle Timeout" default="no" type="Union47594" descr="tcp-idle-timeout is an optional parameter. Use specify-tcp-idle-timeout yes to enable tcp-idle-timeout for use."/>
    <member name="specify-fragment-reassembly-timeout" guiName="Specify Fragment Reassembly Timeout" default="no" type="Union47590" descr="fragment-reassembly-timeout is an optional parameter. Use specify-fragment-reassembly-timeout yes to enable fragment-reassembly-timeout for use."/>
    <member name="specify-max-fragments-per-dgram" guiName="Specify Max Fragments per Datagram" default="no" type="Union47587" descr="max-fragments-per-dgram is an optional parameter. Use specify-max-fragments-per-dgram yes to enable max-fragments-per-dgram for use."/>
    <member name="specify-max-small-frags" guiName="Specify Max Small Frags" default="no" type="Union47584" descr="max-small-frags is an optional parameter. Use specify-max-small-frags yes to enable max-small-frags for use."/>
    <member name="specify-min-fragment-size" guiName="Specify Min Fragment Size" default="no" type="Union47582" descr="min-fragment-size is an optional parameter. Use specify-min-fragment-size yes to enable min-fragment-size for use."/>
    <member name="specify-max-partial-dgrams" guiName="Specify Max Partial Datagrams" default="no" type="Union47578" descr="max-partial-dgrams is an optional parameter. Use specify-max-partial-dgrams yes to enable max-partial-dgrams for use."/>
    <member name="specify-max-dgram-size" guiName="Specify Max Datagram Size" default="no" type="Union47575" descr="max-dgram-size is an optional parameter. Use specify-max-dgram-size yes to enable max-dgram-size for use."/>
    <member name="specify-max-fragments" guiName="Specify Max Fragments" default="no" type="Union47572" descr="max-fragments is an optional parameter. Use specify-max-fragments yes to enable max-fragments for use."/>
    <member name="specify-max-last-fragments" guiName="Specify Max Last Fragments" default="no" type="Union47550" descr="max-last-fragments is an optional parameter. Use specify-max-last-fragments yes to enable max-last-fragments for use."/>
    <member name="specify-hijack-max-old-ack" guiName="Specify Hijack Max Old Ack" default="no" type="Union47524" descr="hijack-max-old-ack is an optional parameter. Use specify-hijack-max-old-ack yes to enable hijack-max-old-ack for use."/>
    <member name="specify-syn-flood-max-embrionic" guiName="Specify SYN Flood Max Embrionic" default="no" type="Union48632" descr="syn-flood-max-embrionic is an optional parameter. Use specify-syn-flood-max-embrionic yes to enable syn-flood-max-embrionic for use."/>
  </tStruct>
  <tStruct typeName="Struct47833" >
    <member name="name" guiName="Name" type="String" descr="Name of content type"/>
    <member name="content-type-details" guiName="Content Type Details" type="Union48623" descr="content-type-details"/>
  </tStruct>
  <tStruct typeName="Struct48380" >
    <member name="enforce-accept-content-types" guiName="Enfore Accept Content Types" default="false" type="Bool" descr="enforce-accept-content-types"/>
    <member name="recognized-content-types" guiName="Recognized Content Types" type="List47764" descr="recognized-content-type"/>
  </tStruct>
  <tStruct typeName="Struct48150" >
    <member name="alarm-on-non-http-traffic" guiName="Alarm on Non-HTTP Traffic" default="true" type="Bool" descr="Fire an alert when non http traffic is detected"/>
  </tStruct>
  <tStruct typeName="Struct48646" >
    <member name="dest-ports" guiName="Dest Ports" type="IntegerRange0-65535am" descr="Destination ports"/>
  </tStruct>
  <tStruct typeName="Struct48675" >
    <member name="external-rate-limit-type" guiName="External Rate Limit Type" default="percentage" type="Union48676" descr="Rate limit setting for this signature."/>
  </tStruct>
  <tStruct typeName="Struct48425" >
    <member name="event-count" guiName="Event Count" default="1" type="Integer1-655351" descr="Number of times an event must occur before an alert is generated"/>
    <member name="event-count-key" guiName="Event Count Key" default="Axxx" type="Enum48422" descr="The Storage Type on which to count events for this signature."/>
    <member name="specify-alert-interval" guiName="Specify Alert Interval" default="no" type="Union48388" descr="alert-interval is an optional parameter. Use specify-alert-interval yes to enable alert-interval for use."/>
  </tStruct>
  <tStruct typeName="Struct48648" >
    <member name="exact-spacing" guiName="Exact Spacing" default="0" type="Integer0-655350" descr="Exact number of spacing between regexes."/>
  </tStruct>
  <tStruct typeName="Struct48401" >
    <member name="specify-summary-threshold" guiName="Specify Summary Threshold" default="no" type="Union48406" descr="summary-threshold is an optional parameter. Use specify-summary-threshold yes to enable summary-threshold for use."/>
    <member name="summary-key" guiName="Summary Key" default="Axxx" type="Enum48410" descr="The Storage Type on which to summarize this signature."/>
  </tStruct>
  <tStruct typeName="Struct47864" >
    <member name="summary-key" guiName="Summary Key" default="Axxx" type="Enum47809" descr="The Storage Type on which to summarize this signature."/>
    <member name="specify-global-summary-threshold" guiName="Specify Global Summary Threshold" default="no" type="Union47949" descr="global-summary-threshold is an optional parameter. Use specify-global-summary-threshold yes to enable global-summary-threshold for use."/>
  </tStruct>
  <tStruct typeName="Struct49078" >
    <member name="max-payload-inspect-length" guiName="Max Payload Inspect Length" default="1" type="Integer1-2501" descr="Maximum inspection depth for signature"/>
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum49084" descr="What action(s) to perform when alert is triggered"/>
    <member name="direction" guiName="Direction" default="to-service" type="Enum49081" descr="Direction of Traffic"/>
    <member name="regex-string" guiName="Regex String" type="String" descr="Regular expression to search for"/>
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" default="no" type="Union49096" descr="exact-match-offset is an optional parameter. Use specify-exact-match-offset yes to enable exact-match-offset for use."/>
    <member name="specify-icmp-type" guiName="Specify ICMP type Exclusion" default="no" type="Union49108" descr=" "/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union49112" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
    <member name="swap-attacker-victim" guiName="Swap Attacker and Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct49079" >
    <member name="direction" guiName="Direction" default="to-service" type="Enum49121" descr="Direction of Traffic"/>
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum49124" descr="What action(s) to perform when alert is triggered"/>
    <member name="max-payload-inspect-length" guiName="Max Payload Inspect Length" default="1" type="Integer1-2501" descr="Maximum inspection depth for signature"/>
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" default="no" type="Union49141" descr="exact-match-offset is an optional parameter. Use specify-exact-match-offset yes to enable exact-match-offset for use."/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union49153" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
    <member name="specify-service-ports" guiName="Service Ports" default="no" type="Union49159" descr=" "/>
    <member name="swap-attacker-victim" guiName="Swap Attacker and Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct49080" >
    <member name="direction" guiName="Direction" default="to-service" type="Enum49162" descr="Direction of Traffic"/>
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum49165" descr="What action(s) to perform when alert is triggered"/>
    <member name="max-payload-inspect-length" guiName="Max Payload Inspect Length" default="1" type="Integer1-2501" descr="Maximum inspection depth for signature"/>
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" default="no" type="Union49180" descr="exact-match-offset is an optional parameter. Use specify-exact-match-offset yes to enable exact-match-offset for use."/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union49192" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
    <member name="specify-service-ports" guiName="Service Ports" default="no" type="Union49197" descr=" "/>
    <member name="swap-attacker-victim" guiName="Swap Attacker and Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct48192" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48483" descr="What action(s) to perform when alert is triggered."/>
    <member name="event-action-settings" guiName="Event Action Settings" type="Struct48675" descr=" "/>
    <member name="rate" guiName="Rate" type="Integer0-65535" descr="Threshold number of packets-per-second.  An alarm fires when you get a second where Rate is greater than PPS."/>
    <member name="protocol" guiName="Protocol" type="Union47674" descr="Protocol of interest for this inspector."/>
  </tStruct>
  <tStruct typeName="Struct48195" >
    <member name="event-action" guiName="Event Action" type="Enum48483" descr=" "/>
    <member name="event-action-settings" guiName="Event Action Settings" type="Struct48675" descr=" "/>
    <member name="gap" guiName="Gap" type="Integer0-65535" descr="Gap in seconds of time allowable for a flood signature."/>
    <member name="peaks" guiName="Peaks" type="Integer0-65535" descr="Number of allowed peaks flood traffic"/>
    <member name="rate" guiName="Rate" type="Integer0-65535" descr="Threshold number of packets-per-second.  An alarm fires when you get a second where Rate is greater than PPS."/>
    <member name="protocol" guiName="Protocol" type="Union47804" descr="Protocol of interest for this inspector."/>
    <member name="sampling-interval" guiName="Sampling Interval" default="30" type="Integer1-360030" descr="Interval used in sampling traffic"/>
  </tStruct>
  <tStruct typeName="Struct47592" >
    <member name="ftp-command" guiName="FTP Command" type="Enum48148" descr="FTP command inspection."/>
  </tStruct>
  <tStruct typeName="Struct48402" >
    <member name="summary-interval" guiName="Summary Interval" default="15" type="Integer1-6553515" descr="Time in seconds used in each summary alert"/>
  </tStruct>
  <tStruct typeName="Struct48259" >
  </tStruct>
  <tStruct typeName="Struct48258" >
  </tStruct>
  <tStruct typeName="Struct47667" >
    <member name="specify-icmp-type" guiName="Specify ICMP Type" default="no" type="Union47937" descr="icmp-type is an optional parameter. Use specify-icmp-type yes to enable icmp-type for use."/>
    <member name="storage-key" guiName="Storage Key" type="Enum47769" descr="Type of Address Key used to store persistent data."/>
  </tStruct>
  <tStruct typeName="Struct47673" >
    <member name="icmp-type" guiName="ICMP Type" type="Integer0-65535" descr="ICMP header TYPE value"/>
  </tStruct>
  <tStruct typeName="Struct47805" >
    <member name="specify-icmp-type" guiName="Specify ICMP Type" default="no" type="Union47728" descr="icmp-type is an optional parameter. Use specify-icmp-type yes to enable icmp-type for use."/>
  </tStruct>
  <tStruct typeName="Struct48176" >
    <member name="specify-icmp-seq" guiName="Specify ICMP Sequence" default="no" type="Union48103" descr="icmp-seq is an optional parameter. Use specify-icmp-seq yes to enable icmp-seq for use."/>
    <member name="specify-icmp-type" guiName="Specify ICMP Type" default="no" type="Union48073" descr="icmp-type is an optional parameter. Use specify-icmp-type yes to enable icmp-type for use."/>
    <member name="specify-icmp-code" guiName="Specify ICMP Code" default="no" type="Union48070" descr="icmp-code is an optional parameter. Use specify-icmp-code yes to enable icmp-code for use."/>
    <member name="specify-icmp-id" guiName="Specify ICMP Identifier" default="no" type="Union48068" descr="icmp-id is an optional parameter. Use specify-icmp-id yes to enable icmp-id for use."/>
    <member name="specify-icmp-total-length" guiName="Specify ICMP Total Length" default="no" type="Union48064" descr="icmp-total-length is an optional parameter. Use specify-icmp-total-length yes to enable icmp-total-length for use."/>
  </tStruct>
  <tStruct typeName="Struct48537" >
  </tStruct>
  <tStruct typeName="Struct48266" >
    <member name="mode" guiName="Operation Mode" type="Integer0-65535" descr="Mode of NTP packet"/>
    <member name="max-control-data-size" guiName="Max Control Data Size" type="Integer0-65535" descr="Maximum allowed amount of data sent in a control packet"/>
    <member name="control-opcode" guiName="Control Opcode" type="Integer0-65535" descr="Opcode number of an NTP control packet, accoding to RFC1305, Appendix B"/>
  </tStruct>
  <tStruct typeName="Struct48291" >
  </tStruct>
  <tStruct typeName="Struct48041" >
    <member name="specify-src-ip-addr" guiName="Specify Source IP Addresses" default="no" type="Union47741" descr="src-ip-addr is an optional parameter. Use specify-src-ip-addr yes to enable src-ip-addr for use."/>
    <member name="specify-dst-ip-addr" guiName="Specify Destination IP Addresses" default="no" type="Union47737" descr="dst-ip-addr is an optional parameter. Use specify-dst-ip-addr yes to enable dst-ip-addr for use."/>
  </tStruct>
  <tStruct typeName="Struct48267" >
  </tStruct>
  <tStruct typeName="Struct48360" >
  </tStruct>
  <tStruct typeName="Struct48361" >
  </tStruct>
  <tStruct typeName="Struct48268" >
  </tStruct>
  <tStruct typeName="Struct48603" >
    <member name="length" guiName="Length" type="Integer0-65535" descr="Keys larger than this will fire RSAREF overflow."/>
  </tStruct>
  <tStruct typeName="Struct47531" >
    <member name="state-name" guiName="State Name" type="Enum48322" descr="Name of state required before producing an alert"/>
  </tStruct>
  <tStruct typeName="Struct48128" >
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="specify-end-match-offset" guiName="Specify End Match Offset" default="no" type="Union47831" descr="end-match-offset is an optional parameter. Use specify-end-match-offset yes to enable end-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct48613" >
    <member name="define-magic-number" guiName="Define Magic Number" type="List48130" descr="define-magic-number"/>
  </tStruct>
  <tStruct typeName="Struct48238" >
    <member name="specify-max-uri-field-length" guiName="Specify Max URI Field Length" default="no" type="Union48248" descr="max-uri-field-length is an optional parameter. Use specify-max-uri-field-length yes to enable max-uri-field-length for use."/>
    <member name="specify-max-arg-field-length" guiName="Specify Max Arg Field Length" default="no" type="Union48241" descr="max-arg-field-length is an optional parameter. Use specify-max-arg-field-length yes to enable max-arg-field-length for use."/>
    <member name="specify-max-header-field-length" guiName="Specify Max Header Field Length" default="no" type="Union48239" descr="max-header-field-length is an optional parameter. Use specify-max-header-field-length yes to enable max-header-field-length for use."/>
    <member name="specify-max-request-length" guiName="Specify Max Request Field Length" default="no" type="Union48246" descr="max-request-length is an optional parameter. Use specify-max-request-length yes to enable max-request-length for use."/>
  </tStruct>
  <tStruct typeName="Struct48541" >
  </tStruct>
  <tStruct typeName="Struct48511" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
    <member name="meta-reset-interval" guiName="Meta Reset Interval" default="60" type="Integer0-360060" descr="Time in seconds to reset the META signature"/>
    <member name="component-list" guiName="Component List" type="List48520" descr="List of META components."/>
    <member name="meta-key" guiName="Meta Key" default="Axxx" type="Union48525" descr="Storage type for the META signature"/>
    <member name="component-list-in-order" guiName="Component List In Order" default="false" type="Bool" descr="Whether the component list fires in order or not"/>
    <member name="all-components-required" guiName="All Components Required" default="true" type="Bool" descr="All compontents must trigger in order to trigger meta alert"/>
  </tStruct>
  <tStruct typeName="Struct48649" >
    <member name="min-spacing" guiName="Minimum Spacing" default="0" type="Integer0-655350" descr="Minimum length of spacing allowed between regexes"/>
  </tStruct>
  <tStruct typeName="Struct48146" >
    <member name="regex-list" guiName="Regex List" type="List48144" descr="List of regular expressions"/>
    <member name="regex-list-in-order" guiName="Regex List In Order" type="Bool" descr="Whether the regex list should be in order or not"/>
  </tStruct>
  <tStruct typeName="Struct48542" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="inspect-length" guiName="Inspect Length" default="4294967295" type="Integer0-42949672954294967295" descr="Number of bytes to inspect in a packet/stream"/>
    <member name="protocol" guiName="Protocol" type="Union48543" descr="Protocol of interest for this inspector."/>
    <member name="regex-component-list" guiName="Regex Component" type="List48615" descr="Regex component grouping"/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct47403" >
  </tStruct>
  <tStruct typeName="Struct47407" >
  </tStruct>
  <tStruct typeName="Struct47411" >
  </tStruct>
  <tStruct typeName="Struct47414" >
    <member name="specify-max-match-offset" guiName="Specify Max Match Offset" default="no" type="Union47415" descr="max-match-offset is an optional parameter. Use specify-max-match-offset yes to enable max-match-offset for use."/>
    <member name="specify-min-match-offset" guiName="Specify Min Match Offset" default="no" type="Union47410" descr="min-match-offset is an optional parameter. Use specify-min-match-offset yes to enable min-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct47420" >
  </tStruct>
  <tStruct typeName="Struct47426" >
  </tStruct>
  <tStruct typeName="Struct47434" >
  </tStruct>
  <tStruct typeName="Struct47442" >
  </tStruct>
  <tStruct typeName="Struct47444" >
  </tStruct>
  <tStruct typeName="Struct47451" >
  </tStruct>
  <tStruct typeName="Struct47455" >
  </tStruct>
  <tStruct typeName="Struct47457" >
  </tStruct>
  <tStruct typeName="Struct47463" >
  </tStruct>
  <tStruct typeName="Struct47484" >
  </tStruct>
  <tStruct typeName="Struct47490" >
  </tStruct>
  <tStruct typeName="Struct47497" >
  </tStruct>
  <tStruct typeName="Struct47501" >
  </tStruct>
  <tStruct typeName="Struct47503" >
    <member name="specify-max-match-offset" guiName="Specify Max Match Offset" default="no" type="Union47498" descr="max-match-offset is an optional parameter. Use specify-max-match-offset yes to enable max-match-offset for use."/>
    <member name="specify-min-match-offset" guiName="Specify Min Match Offset" default="no" type="Union47502" descr="min-match-offset is an optional parameter. Use specify-min-match-offset yes to enable min-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct47506" >
  </tStruct>
  <tStruct typeName="Struct47534" >
  </tStruct>
  <tStruct typeName="Struct47545" >
  </tStruct>
  <tStruct typeName="Struct47547" >
    <member name="specify-min-match-offset" guiName="Specify Min Match Offset" default="no" type="Union48278" descr="min-match-offset is an optional parameter. Use specify-min-match-offset yes to enable min-match-offset for use."/>
    <member name="specify-max-match-offset" guiName="Specify Max Match Offset" default="no" type="Union48480" descr="max-match-offset is an optional parameter. Use specify-max-match-offset yes to enable max-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct47549" >
  </tStruct>
  <tStruct typeName="Struct47571" >
  </tStruct>
  <tStruct typeName="Struct47573" >
  </tStruct>
  <tStruct typeName="Struct47576" >
  </tStruct>
  <tStruct typeName="Struct47580" >
  </tStruct>
  <tStruct typeName="Struct47583" >
  </tStruct>
  <tStruct typeName="Struct47586" >
  </tStruct>
  <tStruct typeName="Struct47589" >
  </tStruct>
  <tStruct typeName="Struct47593" >
  </tStruct>
  <tStruct typeName="Struct47596" >
  </tStruct>
  <tStruct typeName="Struct47598" >
  </tStruct>
  <tStruct typeName="Struct47602" >
  </tStruct>
  <tStruct typeName="Struct47605" >
  </tStruct>
  <tStruct typeName="Struct47608" >
  </tStruct>
  <tStruct typeName="Struct47611" >
  </tStruct>
  <tStruct typeName="Struct47631" >
  </tStruct>
  <tStruct typeName="Struct47638" >
  </tStruct>
  <tStruct typeName="Struct47653" >
  </tStruct>
  <tStruct typeName="Struct47656" >
  </tStruct>
  <tStruct typeName="Struct47659" >
  </tStruct>
  <tStruct typeName="Struct47662" >
  </tStruct>
  <tStruct typeName="Struct47665" >
  </tStruct>
  <tStruct typeName="Struct47679" >
  </tStruct>
  <tStruct typeName="Struct47681" >
  </tStruct>
  <tStruct typeName="Struct47685" >
  </tStruct>
  <tStruct typeName="Struct47688" >
  </tStruct>
  <tStruct typeName="Struct47698" >
  </tStruct>
  <tStruct typeName="Struct47727" >
  </tStruct>
  <tStruct typeName="Struct47736" >
  </tStruct>
  <tStruct typeName="Struct47740" >
  </tStruct>
  <tStruct typeName="Struct47743" >
  </tStruct>
  <tStruct typeName="Struct47746" >
  </tStruct>
  <tStruct typeName="Struct47749" >
  </tStruct>
  <tStruct typeName="Struct47754" >
  </tStruct>
  <tStruct typeName="Struct47773" >
  </tStruct>
  <tStruct typeName="Struct47798" >
  </tStruct>
  <tStruct typeName="Struct47801" >
  </tStruct>
  <tStruct typeName="Struct47812" >
  </tStruct>
  <tStruct typeName="Struct47814" >
  </tStruct>
  <tStruct typeName="Struct47816" >
  </tStruct>
  <tStruct typeName="Struct47827" >
  </tStruct>
  <tStruct typeName="Struct47844" >
  </tStruct>
  <tStruct typeName="Struct47845" >
  </tStruct>
  <tStruct typeName="Struct47848" >
  </tStruct>
  <tStruct typeName="Struct47899" >
  </tStruct>
  <tStruct typeName="Struct47902" >
  </tStruct>
  <tStruct typeName="Struct47906" >
  </tStruct>
  <tStruct typeName="Struct47909" >
  </tStruct>
  <tStruct typeName="Struct47923" >
  </tStruct>
  <tStruct typeName="Struct47928" >
  </tStruct>
  <tStruct typeName="Struct47929" >
  </tStruct>
  <tStruct typeName="Struct47934" >
  </tStruct>
  <tStruct typeName="Struct47938" >
  </tStruct>
  <tStruct typeName="Struct47941" >
  </tStruct>
  <tStruct typeName="Struct47946" >
  </tStruct>
  <tStruct typeName="Struct47950" >
  </tStruct>
  <tStruct typeName="Struct47956" >
  </tStruct>
  <tStruct typeName="Struct47959" >
  </tStruct>
  <tStruct typeName="Struct47963" >
  </tStruct>
  <tStruct typeName="Struct47967" >
  </tStruct>
  <tStruct typeName="Struct47968" >
  </tStruct>
  <tStruct typeName="Struct47972" >
  </tStruct>
  <tStruct typeName="Struct47975" >
  </tStruct>
  <tStruct typeName="Struct47978" >
  </tStruct>
  <tStruct typeName="Struct47991" >
  </tStruct>
  <tStruct typeName="Struct48010" >
  </tStruct>
  <tStruct typeName="Struct48024" >
  </tStruct>
  <tStruct typeName="Struct48042" >
  </tStruct>
  <tStruct typeName="Struct48046" >
  </tStruct>
  <tStruct typeName="Struct48050" >
  </tStruct>
  <tStruct typeName="Struct48051" >
  </tStruct>
  <tStruct typeName="Struct48055" >
  </tStruct>
  <tStruct typeName="Struct48063" >
  </tStruct>
  <tStruct typeName="Struct48066" >
  </tStruct>
  <tStruct typeName="Struct48069" >
  </tStruct>
  <tStruct typeName="Struct48072" >
  </tStruct>
  <tStruct typeName="Struct48076" >
  </tStruct>
  <tStruct typeName="Struct48081" >
  </tStruct>
  <tStruct typeName="Struct48084" >
  </tStruct>
  <tStruct typeName="Struct48087" >
  </tStruct>
  <tStruct typeName="Struct48090" >
  </tStruct>
  <tStruct typeName="Struct48092" >
  </tStruct>
  <tStruct typeName="Struct48095" >
  </tStruct>
  <tStruct typeName="Struct48098" >
  </tStruct>
  <tStruct typeName="Struct48101" >
  </tStruct>
  <tStruct typeName="Struct48105" >
  </tStruct>
  <tStruct typeName="Struct48107" >
  </tStruct>
  <tStruct typeName="Struct48135" >
  </tStruct>
  <tStruct typeName="Struct48138" >
  </tStruct>
  <tStruct typeName="Struct48165" >
    <member name="specify-min-match-offset" guiName="Specify Min Match Offset" default="no" type="Union48168" descr="min-match-offset is an optional parameter. Use specify-min-match-offset yes to enable min-match-offset for use."/>
    <member name="specify-max-match-offset" guiName="Specify Max Match Offset" default="no" type="Union48166" descr="max-match-offset is an optional parameter. Use specify-max-match-offset yes to enable max-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct48169" >
  </tStruct>
  <tStruct typeName="Struct48171" >
  </tStruct>
  <tStruct typeName="Struct48175" >
  </tStruct>
  <tStruct typeName="Struct48221" >
  </tStruct>
  <tStruct typeName="Struct48224" >
  </tStruct>
  <tStruct typeName="Struct48227" >
  </tStruct>
  <tStruct typeName="Struct48230" >
  </tStruct>
  <tStruct typeName="Struct48234" >
  </tStruct>
  <tStruct typeName="Struct48240" >
  </tStruct>
  <tStruct typeName="Struct48243" >
  </tStruct>
  <tStruct typeName="Struct48245" >
  </tStruct>
  <tStruct typeName="Struct48249" >
  </tStruct>
  <tStruct typeName="Struct48264" >
  </tStruct>
  <tStruct typeName="Struct48281" >
  </tStruct>
  <tStruct typeName="Struct48311" >
  </tStruct>
  <tStruct typeName="Struct48333" >
  </tStruct>
  <tStruct typeName="Struct48341" >
    <member name="specify-max-match-offset" guiName="Specify Max Match Offset" default="no" type="Union48384" descr="max-match-offset is an optional parameter. Use specify-max-match-offset yes to enable max-match-offset for use."/>
    <member name="specify-min-match-offset" guiName="Specify Min Match Offset" default="no" type="Union48342" descr="min-match-offset is an optional parameter. Use specify-min-match-offset yes to enable min-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct48343" >
  </tStruct>
  <tStruct typeName="Struct48345" >
  </tStruct>
  <tStruct typeName="Struct48353" >
  </tStruct>
  <tStruct typeName="Struct48382" >
  </tStruct>
  <tStruct typeName="Struct48386" >
  </tStruct>
  <tStruct typeName="Struct48438" >
  </tStruct>
  <tStruct typeName="Struct48442" >
  </tStruct>
  <tStruct typeName="Struct48471" >
  </tStruct>
  <tStruct typeName="Struct48484" >
  </tStruct>
  <tStruct typeName="Struct48488" >
  </tStruct>
  <tStruct typeName="Struct48509" >
  </tStruct>
  <tStruct typeName="Struct48517" >
  </tStruct>
  <tStruct typeName="Struct48539" >
  </tStruct>
  <tStruct typeName="Struct48562" >
  </tStruct>
  <tStruct typeName="Struct48565" >
  </tStruct>
  <tStruct typeName="Struct48568" >
  </tStruct>
  <tStruct typeName="Struct48571" >
  </tStruct>
  <tStruct typeName="Struct48575" >
  </tStruct>
  <tStruct typeName="Struct48578" >
  </tStruct>
  <tStruct typeName="Struct48581" >
  </tStruct>
  <tStruct typeName="Struct48584" >
  </tStruct>
  <tStruct typeName="Struct48587" >
  </tStruct>
  <tStruct typeName="Struct48590" >
  </tStruct>
  <tStruct typeName="Struct48593" >
  </tStruct>
  <tStruct typeName="Struct48596" >
  </tStruct>
  <tStruct typeName="Struct48599" >
  </tStruct>
  <tStruct typeName="Struct48630" >
  </tStruct>
  <tStruct typeName="Struct48652" >
  </tStruct>
  <tStruct typeName="Struct48667" >
  </tStruct>
  <tStruct typeName="Struct48673" >
  </tStruct>
  <tStruct typeName="Struct48728" >
  </tStruct>
  <tStruct typeName="Struct49076" >
  </tStruct>
  <tStruct typeName="Struct49099" >
    <member name="specify-max-match-offset" guiName="Specify Max Match Offset" default="no" type="Union49104" descr="max-match-offset is an optional parameter. Use specify-max-match-offset yes to enable max-match-offset for use."/>
    <member name="specify-min-match-offset" guiName="Specify Min Match Offset" default="no" type="Union49100" descr="min-match-offset is an optional parameter. Use specify-min-match-offset yes to enable min-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct49103" >
  </tStruct>
  <tStruct typeName="Struct49107" >
  </tStruct>
  <tStruct typeName="Struct49109" >
  </tStruct>
  <tStruct typeName="Struct49115" >
  </tStruct>
  <tStruct typeName="Struct49144" >
    <member name="specify-max-match-offset" guiName="Specify Max Match Offset" default="no" type="Union49149" descr="max-match-offset is an optional parameter. Use specify-max-match-offset yes to enable max-match-offset for use."/>
    <member name="specify-min-match-offset" guiName="Specify Min Match Offset" default="no" type="Union49145" descr="min-match-offset is an optional parameter. Use specify-min-match-offset yes to enable min-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct49148" >
  </tStruct>
  <tStruct typeName="Struct49152" >
  </tStruct>
  <tStruct typeName="Struct49156" >
  </tStruct>
  <tStruct typeName="Struct49160" >
  </tStruct>
  <tStruct typeName="Struct49183" >
    <member name="specify-max-match-offset" guiName="Specify Max Match Offset" default="no" type="Union49188" descr="max-match-offset is an optional parameter. Use specify-max-match-offset yes to enable max-match-offset for use."/>
    <member name="specify-min-match-offset" guiName="Specify Min Match Offset" default="no" type="Union49184" descr="min-match-offset is an optional parameter. Use specify-min-match-offset yes to enable min-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct49187" >
  </tStruct>
  <tStruct typeName="Struct49191" >
  </tStruct>
  <tStruct typeName="Struct49195" >
  </tStruct>
  <tStruct typeName="Struct49198" >
  </tStruct>
  <tStruct typeName="Struct47759" >
  </tStruct>
  <tStruct typeName="Struct48003" >
  </tStruct>
  <tStruct typeName="Struct48292" >
  </tStruct>
  <tStruct typeName="Struct48677" >
  </tStruct>
  <tStruct typeName="Struct47628" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum47569" descr="What action(s) to perform when alert is triggered"/>
    <member name="event-action-settings" guiName="Event Action Settings" type="Struct48675" descr=" "/>
    <member name="edit-default-sigs-only" guiName="Edit Defaults" default="no-custom-signatures" type="Union48004" descr="Editable signatures"/>
  </tStruct>
  <tStruct typeName="Struct48451" >
    <member name="other-ip-protocol-id" guiName="Other IP Protocol Identifier" type="IntegerRange0-256" descr="A single IP Protocol Number to alarm on."/>
  </tStruct>
  <tStruct typeName="Struct48678" >
    <member name="external-rate-limit-percentage" guiName="External Rate Limit Percentage" default="100" type="Integer1-100100" descr="Percentage of traffic to allow when rate limiting is activated for this signature."/>
  </tStruct>
  <tStruct typeName="Struct47613" >
    <member name="content-type" guiName="Content Type" type="String" descr="content-type"/>
  </tStruct>
  <tStruct typeName="Struct47558" >
    <member name="request-method" guiName="Request Method" type="String" descr="Request method definition"/>
  </tStruct>
  <tStruct typeName="Struct47557" >
    <member name="transfer-encoding" guiName="Transfer Encoding" type="String" descr="Transfer encoding definition"/>
  </tStruct>
  <tStruct typeName="Struct48218" >
    <member name="specify-uri-regex" guiName="Specify URI Regex" default="no" type="Union48233" descr="uri-regex is an optional parameter. Use specify-uri-regex yes to enable uri-regex for use."/>
    <member name="specify-arg-name-regex" guiName="Specify Arg Name Regex" default="no" type="Union48220" descr="arg-name-regex is an optional parameter. Use specify-arg-name-regex yes to enable arg-name-regex for use."/>
    <member name="specify-header-regex" guiName="Specify Header Regex" default="no" type="Union48231" descr="header-regex is an optional parameter. Use specify-header-regex yes to enable header-regex for use."/>
    <member name="specify-request-regex" guiName="Specify Request Regex" default="no" type="Union48226" descr="request-regex is an optional parameter. Use specify-request-regex yes to enable request-regex for use."/>
  </tStruct>
  <tStruct typeName="Struct48616" >
    <member name="regex-string" guiName="Regex String" default="Regex String" type="StringaaRegex_String" descr="A regular expression to search for in a single TCP packet"/>
    <member name="spacing-type" guiName="Spacing Type" default="minimum" type="Union48617" descr="Type of regex spacing used in signature"/>
  </tStruct>
  <tStruct typeName="Struct48145" >
    <member name="regex-pattern" guiName="Regex Pattern" type="Stringaa" descr="Regular expression"/>
    <member name="specify-regex-min-match-length" guiName="Specify Regex Min Match Length" default="no" type="Union48139" descr="regex-min-match-length is an optional parameter. Use specify-regex-min-match-length yes to enable regex-min-match-length for use."/>
    <member name="specify-regex-end-offset" guiName="Specify Regex End Offset" default="no" type="Union48137" descr="regex-end-offset is an optional parameter. Use specify-regex-end-offset yes to enable regex-end-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct47994" >
  </tStruct>
  <tStruct typeName="Struct48037" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="protocol" guiName="Protocol" type="Enum47643" descr="Protocol of interest for this inspector."/>
    <member name="specify-query-type" guiName="Specify Query Type" default="no" type="Union48196" descr="query-type is an optional parameter. Use specify-query-type yes to enable query-type for use."/>
    <member name="specify-query-opcode" guiName="Specify Query Opcode" default="no" type="Union48035" descr="query-opcode is an optional parameter. Use specify-query-opcode yes to enable query-opcode for use."/>
    <member name="specify-query-record-data-len" guiName="Specify Query Record Data Length" default="no" type="Union47976" descr="query-record-data-len is an optional parameter. Use specify-query-record-data-len yes to enable query-record-data-len for use."/>
    <member name="specify-query-record-data-invalid" guiName="Specify Query Record Data Invalid" default="no" type="Union47973" descr="query-record-data-invalid is an optional parameter. Use specify-query-record-data-invalid yes to enable query-record-data-invalid for use."/>
    <member name="specify-query-src-port-53" guiName="Specify Query Src Port 53" default="no" type="Union47970" descr="query-src-port-53 is an optional parameter. Use specify-query-src-port-53 yes to enable query-src-port-53 for use."/>
    <member name="specify-query-value" guiName="Specify Query Value" default="no" type="Union47850" descr="query-value is an optional parameter. Use specify-query-value yes to enable query-value for use."/>
    <member name="specify-query-stream-len" guiName="Specify Query Stream Length" default="no" type="Union47810" descr="query-stream-len is an optional parameter. Use specify-query-stream-len yes to enable query-stream-len for use."/>
    <member name="specify-query-jump-count-exceeded" guiName="Specify Query Jump Count Exceeded" default="no" type="Union47663" descr="query-jump-count-exceeded is an optional parameter. Use specify-query-jump-count-exceeded yes to enable query-jump-count-exceeded for use."/>
    <member name="specify-query-invalid-domain-name" guiName="Specify Query Invalid Domain Name" default="no" type="Union47660" descr="query-invalid-domain-name is an optional parameter. Use specify-query-invalid-domain-name yes to enable query-invalid-domain-name for use."/>
    <member name="specify-query-class" guiName="Specify Query Class" default="no" type="Union47657" descr="query-class is an optional parameter. Use specify-query-class yes to enable query-class for use."/>
    <member name="specify-query-chaos-string" guiName="Specify Query Chaos String" default="no" type="Union47655" descr="query-chaos-string is an optional parameter. Use specify-query-chaos-string yes to enable query-chaos-string for use."/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct48211" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="direction" guiName="Direction" default="to-service" type="Enum48213" descr="Direction of traffic"/>
    <member name="service-ports" guiName="Service Ports" default="21" type="IntegerRange0-65535am21" descr="A comma separated list of ports or port ranges where the target service may reside"/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
    <member name="ftp-inspection-type" guiName="FTP Inspection Type" type="Enum47838" descr="Type of inspection to perform"/>
  </tStruct>
  <tStruct typeName="Struct48365" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="intermediate-instructions" guiName="Intermediate Instructions" type="String" descr="EXPERT USE ONLY: Assembly or Machine code.  Machine-ready (regname,oper,opnd1,opnd2;) in string form."/>
    <member name="specify-dst-port" guiName="Specify Dst Port" default="no" type="Union47689" descr="dst-port is an optional parameter. Use specify-dst-port yes to enable dst-port for use."/>
    <member name="specify-ip-protocol" guiName="Specify IP Protocol" default="no" type="Union47686" descr="ip-protocol is an optional parameter. Use specify-ip-protocol yes to enable ip-protocol for use."/>
    <member name="specify-payload-source" guiName="Specify Payload Source" default="no" type="Union47683" descr="payload-source is an optional parameter. Use specify-payload-source yes to enable payload-source for use."/>
    <member name="direction" guiName="TCP Stream Inspection Direction" default="bi-dir" type="Enum49225" descr="Inspection direction when  payload source=tcp-stream. Ignored otherwise and use default."/>
    <member name="specify-regex-string" guiName="Specify Regex String" default="no" type="Union49073" descr=" "/>
    <member name="specify-src-port" guiName="Specify Src Port" default="no" type="Union47680" descr="src-port is an optional parameter. Use specify-src-port yes to enable src-port for use."/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct48149" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="specify-field-name" guiName="Specify Field Name" default="no" type="Union48363" descr="field-name is an optional parameter. Use specify-field-name yes to enable field-name for use."/>
    <member name="message-type" guiName="Message Type" type="Enum48147" descr="Type of H225 message"/>
    <member name="policy-type" guiName="Policy Type" type="Enum47918" descr="H225 Policy type"/>
    <member name="specify-value-range" guiName="Specify Value Range" default="no" type="Union47910" descr="value-range is an optional parameter. Use specify-value-range yes to enable value-range for use."/>
    <member name="specify-regex-string" guiName="Specify Regex String" default="no" type="Union47907" descr="regex-string is an optional parameter. Use specify-regex-string yes to enable regex-string for use."/>
    <member name="specify-invalid-packet-index" guiName="Specify Invalid Packet Index" default="no" type="Union47900" descr="invalid-packet-index is an optional parameter. Use specify-invalid-packet-index yes to enable invalid-packet-index for use."/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct48217" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="de-obfuscate" guiName="De Obfuscate" default="true" type="Bool" descr="Apply anti-evasive deobfuscation before searching."/>
    <member name="max-field-sizes" guiName="Max Field Sizes" type="Struct48238" descr="Grouping for Max field sizes"/>
    <member name="regex" guiName="Regex" type="Struct48218" descr="Regular expression grouping"/>
    <member name="service-ports" guiName="Service Ports" type="IntegerRange0-65535am" descr="A comma separated list of ports or port ranges where the target service may reside"/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct48252" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="inspection-type" guiName="Inspection Type" type="Union48257" descr="Type of inspection to perform"/>
    <member name="service-ports" guiName="Service Ports" type="IntegerRange0-65535am" descr="A comma separated list of ports or port ranges where the target service may reside"/>
    <member name="direction" guiName="Direction" default="to-service" type="Enum48253" descr="Direction of traffic"/>
  </tStruct>
  <tStruct typeName="Struct48023" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="protocol" guiName="Protocol" type="Union48022" descr="Protocol of interest for this inspector."/>
    <member name="specify-regex-string" guiName="Specify Regex String" default="no" type="Union47546" descr="regex-string is an optional parameter. Use specify-regex-string yes to enable regex-string for use."/>
    <member name="specify-operation" guiName="Specify Operation" default="no" type="Union48464" descr="operation is an optional parameter. Use specify-operation yes to enable operation for use."/>
    <member name="specify-uuid" guiName="Specify UUID" default="no" type="Union48487" descr="uuid is an optional parameter. Use specify-uuid yes to enable uuid for use."/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct48260" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="specify-sql-username" guiName="Specify SQL Username" default="no" type="Union48263" descr="sql-username is an optional parameter. Use specify-sql-username yes to enable sql-username for use."/>
    <member name="password-present" guiName="Password Present" type="Bool" descr="Whether or not a password was used in a MS SQL login."/>
  </tStruct>
  <tStruct typeName="Struct48199" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="inspection-type" guiName="Inspection Type" type="Union48020" descr="Type of inspection to perform"/>
  </tStruct>
  <tStruct typeName="Struct49201" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum49202" descr="What action(s) to perform when alert is triggered"/>
    <member name="direction" guiName="Direction" default="to-service" type="Enum49217" descr="Direction of Traffic"/>
    <member name="protocol" guiName="Protocol" type="Union49220" descr=" "/>
  </tStruct>
  <tStruct typeName="Struct48272" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="direction" guiName="Direction" default="to-service" type="Enum48275" descr="Direction of traffic"/>
    <member name="protocol" guiName="Protocol" type="Enum47651" descr="Protocol of interest for this inspector."/>
    <member name="service-ports" guiName="Service Ports" type="IntegerRange0-65535am" descr="A comma separated list of ports or port ranges where the target service may reside"/>
    <member name="specify-regex-string" guiName="Specify Regex String" default="no" type="Union48651" descr=" "/>
    <member name="specify-port-map-program" guiName="Specify Port Map Program" default="no" type="Union48280" descr="port-map-program is an optional parameter. Use specify-port-map-program yes to enable port-map-program for use."/>
    <member name="specify-rpc-program" guiName="Specify RPC Program" default="no" type="Union48019" descr="rpc-program is an optional parameter. Use specify-rpc-program yes to enable rpc-program for use."/>
    <member name="specify-is-spoof-src" guiName="Specify Spoof Src" default="no" type="Union47996" descr="is-spoof-src is an optional parameter. Use specify-is-spoof-src yes to enable is-spoof-src for use."/>
    <member name="specify-rpc-max-length" guiName="Specify RPC Max Length" default="no" type="Union47990" descr="rpc-max-length is an optional parameter. Use specify-rpc-max-length yes to enable rpc-max-length for use."/>
    <member name="specify-rpc-procedure" guiName="Specify RPC Procedure" default="no" type="Union47799" descr="rpc-procedure is an optional parameter. Use specify-rpc-procedure yes to enable rpc-procedure for use."/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct48534" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="service-ports" guiName="Service Ports" default="139,445" type="IntegerRange0-65535am139comma445" descr="A comma separated list of ports or port ranges where the target service may reside"/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
    <member name="specify-byte-count" guiName="Specify Byte Count" default="no" type="Union48561" descr="byte-count is an optional parameter. Use specify-byte-count yes to enable byte-count for use."/>
    <member name="specify-file-id" guiName="Specify File ID" default="no" type="Union48564" descr="file-id is an optional parameter. Use specify-file-id yes to enable file-id for use."/>
    <member name="specify-hit-count" guiName="Specify Hit Count" default="no" type="Union48567" descr="hit-count is an optional parameter. Use specify-hit-count yes to enable hit-count for use."/>
    <member name="specify-scan-interval" guiName="Specify Scan Interval" default="no" type="Union48570" descr="scan-interval is an optional parameter. Use specify-scan-interval yes to enable scan-interval for use."/>
    <member name="specify-word-count" guiName="Specify Word Count" default="no" type="Union48574" descr="word-count is an optional parameter. Use specify-word-count yes to enable word-count for use."/>
    <member name="specify-type" guiName="Specify Type" default="no" type="Union48577" descr="type is an optional parameter. Use specify-type yes to enable type for use."/>
    <member name="specify-set-count" guiName="Specify Set Count" default="no" type="Union48580" descr="set-count is an optional parameter. Use specify-set-count yes to enable set-count for use."/>
    <member name="specify-resource" guiName="Specify Resource" default="no" type="Union48583" descr="resource is an optional parameter. Use specify-resource yes to enable resource for use."/>
    <member name="specify-operation" guiName="Specify Operation" default="no" type="Union48586" descr="operation is an optional parameter. Use specify-operation yes to enable operation for use."/>
    <member name="specify-function" guiName="Specify Function" default="no" type="Union48589" descr="function is an optional parameter. Use specify-function yes to enable function for use."/>
    <member name="specify-direction" guiName="Specify Direction" default="no" type="Union48592" descr="direction is an optional parameter. Use specify-direction yes to enable direction for use."/>
    <member name="specify-command" guiName="Specify Command" default="no" type="Union48595" descr="command is an optional parameter. Use specify-command yes to enable command for use."/>
    <member name="specify-allocation-hint" guiName="Specify Allocation Hint" default="no" type="Union48598" descr="allocation-hint is an optional parameter. Use specify-allocation-hint yes to enable allocation-hint for use."/>
  </tStruct>
  <tStruct typeName="Struct47510" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="service-ports" guiName="Service Ports" default="139,445" type="IntegerRange0-65535am139comma445" descr="A comma separated list of ports or port ranges where the target service may reside"/>
    <member name="specify-command" guiName="Specify SMB Command" default="no" type="Union47458" descr="SMB Command is an optional parameter. Use specify-command yes to enable command for use."/>
    <member name="specify-direction" guiName="Specify Direction" default="no" type="Union47453" descr="direction is an optional parameter. Use specify-direction yes to enable direction for use."/>
    <member name="specify-operation" guiName="Specify MSRPC over SMB Operation" default="no" type="Union47447" descr="operation is an optional parameter. Use specify-operation yes to enable operation for use."/>
    <member name="specify-regex-string" guiName="Specify Regex String" default="no" type="Union47511" descr="regex-string is an optional parameter. Use specify-regex-string yes to enable regex-string for use."/>
    <member name="specify-scan-interval" guiName="Specify Scan Interval" default="no" type="Union47438" descr="scan-interval is an optional parameter. Use specify-scan-interval yes to enable scan-interval for use."/>
    <member name="specify-tcp-flags" guiName="Specify TCP Flags" default="no" type="Union47483" descr="flags is an optional parameter. Use specify-flags yes to enable flags for use."/>
    <member name="specify-type" guiName="Specify MSRPC over SMB PDU Type" default="no" type="Union47443" descr="MSRPC over SMB PDU Type is an optional parameter. Use specify-type yes to enable type for use."/>
    <member name="specify-uuid" guiName="Specify MSRPC over SMB UUID" default="no" type="Union47461" descr="MSRPC over SMB UUID is an optional parameter. Use specify-uuid yes to enable uuid for use."/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct48289" >
    <member name="inspection-type" guiName="Inspection Type" type="Union48290" descr="Type of inspection to perform"/>
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48637" descr="What action(s) to perform when alert is triggered"/>
  </tStruct>
  <tStruct typeName="Struct48297" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="ssh-version" guiName="SSH Version" default="v1" type="Union48638" descr="Version of SSH protocol to decode"/>
    <member name="length-type" guiName="Length Type" type="Union48444" descr="SSH length type inspection"/>
    <member name="service-ports" guiName="Service Ports" default="22" type="IntegerRange0-65535am22" descr="A comma separated list of ports or port ranges where the target service may reside"/>
    <member name="specify-packet-depth" guiName="Specify Packet Depth" default="no" type="Union47700" descr="packet-depth is an optional parameter. Use specify-packet-depth yes to enable packet-depth for use."/>
  </tStruct>
  <tStruct typeName="Struct47433" >
    <member name="direction" guiName="Direction" default="to-service" type="Enum47432" descr="Direction of traffic"/>
    <member name="event-action" guiName="Event Action" type="Enum48027" descr=" "/>
    <member name="specify-regex-string" guiName="Specify Regex String" default="no" type="Union47428" descr="regex-string is an optional parameter. Use specify-regex-string yes to enable regex-string for use."/>
    <member name="type" guiName="Type Frame Type" type="Integer0-255" descr="TNS Frame Type"/>
  </tStruct>
  <tStruct typeName="Struct48393" >
    <member name="sig-name" guiName="Signature Name" default="My Sig" type="StringaaMy_Sig" descr="Name of Signature"/>
    <member name="sig-string-info" guiName="Alert Notes" default="My Sig Info" type="String0-aaMy_Sig_Info" descr="Additional information about the signature"/>
    <member name="sig-comment" guiName="User Comments" default="Sig Comment" type="String0-aaSig_Comment" descr="Comment for signature"/>
    <member name="alert-traits" guiName="Alert Traits" default="0" type="Integer0-655350" descr="Traits of the alert (IDS user field)"/>
    <member name="release" guiName="Release" default="custom" type="String0-custom" descr="Release signature was most recently updated in"/>
  </tStruct>
  <tStruct typeName="Struct48391" >
    <member name="alert-severity" guiName="Alert Severity" default="medium" type="Enum48418" descr="Severity of the alert"/>
    <member name="sig-fidelity-rating" guiName="Sig Fidelity Rating" default="75" type="Integer0-10075" descr="Rating of the fidelity of signature"/>
    <member name="promisc-delta" guiName="Promiscuous Delta" default="0" type="Integer0-300" descr="Delta value used to determine seriousness of the alert"/>
    <member name="sig-description" guiName="Sig Description" type="Struct48393" descr="Description of signature"/>
    <member name="engine" guiName="Engine" type="Union48434" descr="Select an engine"/>
    <member name="event-counter" guiName="Event Counter" type="Struct48425" descr="Event count settings"/>
    <member name="alert-frequency" guiName="Alert Frequency" type="Struct48396" descr="Summary options for grouping alerts"/>
    <member name="status" guiName="Status" type="Struct48423" descr="Enabled, Retired grouping"/>
    <member name="vulnerable-os" guiName="Vulnerable OS List" default="general-os" type="Enum47523" descr="List of OS types vulnerable to this attack signature."/>
    <member name="specify-mars-category" guiName="Mars Category" default="yes" type="Union48727" descr="This is the MARS category text."/>
  </tStruct>
  <tStruct typeName="Struct48021" >
    <member name="max-bytes" guiName="Max Bytes" type="Integer0-65535" descr="Maximum number of bytes allowed in the ident message"/>
  </tStruct>
  <tStruct typeName="Struct47529" >
    <member name="state-name" guiName="State Name" type="Enum47821" descr="Name of state required before producing an alert"/>
  </tStruct>
  <tStruct typeName="Struct48295" >
    <member name="specify-object-id" guiName="Specify Object ID" default="no" type="Union47866" descr="object-id is an optional parameter. Use specify-object-id yes to enable object-id for use."/>
    <member name="specify-community-name" guiName="Specify Community Name" default="no" type="Union47846" descr="community-name is an optional parameter. Use specify-community-name yes to enable community-name for use."/>
  </tStruct>
  <tStruct typeName="Struct48647" >
    <member name="source-ports" guiName="Source Ports" type="IntegerRange0-65535am" descr="Source ports used in inspection"/>
  </tStruct>
  <tStruct typeName="Struct47829" >
  </tStruct>
  <tStruct typeName="Struct48303" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="state-machine" guiName="State Machine" type="Union47532" descr="State machine grouping"/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union48310" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="direction" guiName="Direction" default="to-service" type="Enum48306" descr="Direction of traffic"/>
    <member name="service-ports" guiName="Service Ports" type="IntegerRange0-65535am" descr="A comma separated list of ports or port ranges where the target service may reside"/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" default="no" type="Union48113" descr="exact-match-offset is an optional parameter. Use specify-exact-match-offset yes to enable exact-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct48423" >
    <member name="enabled" guiName="Enabled" default="true" type="Bool" descr="Signature enabled"/>
    <member name="retired" guiName="Retired" default="false" type="Bool" descr="Retired status of signature"/>
    <member name="obsoletes" guiName="Obsoletes" type="Set48643" descr="Signatures obsoleted by this signature"/>
  </tStruct>
  <tStruct typeName="Struct48326" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48028" descr="What action(s) to perform when alert is triggered"/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union48332" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="direction" guiName="Direction" default="to-service" type="Enum48328" descr="Direction of traffic"/>
    <member name="icmp-type" guiName="ICMP Type" default="0-18" type="IntegerRange0-18am0-18" descr="ICMP header TYPE value"/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" default="no" type="Union48113" descr="exact-match-offset is an optional parameter. Use specify-exact-match-offset yes to enable exact-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct48337" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48027" descr="What action(s) to perform when alert is triggered"/>
    <member name="strip-telnet-options" guiName="Strip Telnet Options" default="false" type="Bool" descr="Strip telnet option characters from data before searching."/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union48344" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="service-ports" guiName="Service Ports" type="IntegerRange0-65535am" descr="A comma separated list of ports or port ranges where the target service may reside"/>
    <member name="direction" guiName="Direction" default="to-service" type="Enum48335" descr="Direction of traffic"/>
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" default="no" type="Union48113" descr="exact-match-offset is an optional parameter. Use specify-exact-match-offset yes to enable exact-match-offset for use."/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct48347" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48453" descr="What action(s) to perform when alert is triggered"/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union48354" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="service-ports" guiName="Service Ports" type="IntegerRange0-65535am" descr="A comma separated list of ports or port ranges where the target service may reside"/>
    <member name="direction" guiName="Direction" default="to-service" type="Enum48348" descr="Direction of traffic"/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" default="no" type="Union48113" descr="exact-match-offset is an optional parameter. Use specify-exact-match-offset yes to enable exact-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct47865" >
    <member name="summary-interval" guiName="Summary Interval" default="15" type="Integer1-6553515" descr="Time in seconds used in each summary alert"/>
    <member name="summary-key" guiName="Summary Key" default="Axxx" type="Enum48404" descr="The Storage Type on which to summarize this signature."/>
    <member name="specify-global-summary-threshold" guiName="Specify Global Summary Threshold" default="no" type="Union47962" descr="global-summary-threshold is an optional parameter. Use specify-global-summary-threshold yes to enable global-summary-threshold for use."/>
  </tStruct>
  <tStruct typeName="Struct48155" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum47389" descr="What action(s) to perform when alert is triggered"/>
    <member name="unique" guiName="Unique" type="Integer0-255" descr="Threshold number of unique port connections between the two hosts."/>
    <member name="protocol" guiName="Protocol" type="Union47668" descr="Protocol of interest for this inspector."/>
    <member name="specify-src-addr-filter" guiName="Src Addr Filter" default="no" type="Union48666" descr=" "/>
    <member name="specify-dst-addr-filter" guiName="Dst Addr Filter" default="no" type="Union48670" descr=" "/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct48372" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum47389" descr="What action(s) to perform when alert is triggered"/>
    <member name="set-tcp-flags" guiName="Set TCP Flags" type="Set48151" descr="TCP flags grouping"/>
    <member name="specify-port-range" guiName="Specify Port Range" default="no" type="Union47931" descr="port-range is an optional parameter. Use specify-port-range yes to enable port-range for use."/>
  </tStruct>
  <tStruct typeName="Struct47669" >
    <member name="suppress-reverse" guiName="Suppress Reverse" default="false" type="Bool" descr="Do not fire when a sweep has fired in the reverse direction on this address set."/>
    <member name="inverted-sweep" guiName="Inverted Sweep" default="false" type="Bool" descr="Use SRCPORT instead of DSTPORT for Unique counting"/>
    <member name="mask" guiName="Mask" type="Enum48374" descr="Mask used in TcpFlags comparison."/>
    <member name="tcp-flags" guiName="TCP Flags" type="Enum48375" descr="TCP Flags to match when masked by Mask."/>
    <member name="fragment-status" guiName="Fragment Status" default="any" type="Enum48369" descr="Specify whether fragments are wanted or not."/>
    <member name="storage-key" guiName="Storage Key" type="Enum47987" descr="Type of Address Key used to store persistent data."/>
    <member name="specify-port-range" guiName="Specify Port Range" default="no" type="Union47930" descr="port-range is an optional parameter. Use specify-port-range yes to enable port-range for use."/>
  </tStruct>
  <tStruct typeName="Struct47774" >
    <member name="type" guiName="Type" type="Integer" descr="Type Field of MSRPC packet. 0 = Request; 2 = Response; 11 = Bind; 12 = Bind Ack"/>
    <member name="specify-flags" guiName="Specify Flags" default="no" type="Union47535" descr="flags is an optional parameter. Use specify-flags yes to enable flags for use."/>
  </tStruct>
  <tStruct typeName="Struct47807" >
  </tStruct>
  <tStruct typeName="Struct48450" >
    <member name="tcp-flags" guiName="TCP Flags" type="Enum48436" descr="TCP Flags to match when masked by Mask."/>
    <member name="specify-tcp-window-size" guiName="Specify TCP Window Size" default="no" type="Union48174" descr="tcp-window-size is an optional parameter. Use specify-tcp-window-size yes to enable tcp-window-size for use."/>
    <member name="tcp-mask" guiName="TCP Mask" type="Enum48159" descr="Mask used in TcpFlags comparison."/>
    <member name="specify-tcp-payload-length" guiName="Specify TCP Payload Length" default="no" type="Union48156" descr="tcp-payload-length is an optional parameter. Use specify-tcp-payload-length yes to enable tcp-payload-length for use."/>
    <member name="specify-tcp-urg-pointer" guiName="Specify TCP Urgent Pointer" default="no" type="Union48056" descr="tcp-urg-pointer is an optional parameter. Use specify-tcp-urg-pointer yes to enable tcp-urg-pointer for use."/>
    <member name="specify-tcp-header-length" guiName="Specify TCP Header Length" default="no" type="Union48047" descr="tcp-header-length is an optional parameter. Use specify-tcp-header-length yes to enable tcp-header-length for use."/>
    <member name="specify-tcp-reserved" guiName="Specify TCP Reserved" default="no" type="Union48044" descr="tcp-reserved is an optional parameter. Use specify-tcp-reserved yes to enable tcp-reserved for use."/>
    <member name="specify-dst-port" guiName="Specify Destination Port Range" default="no" type="Union47747" descr="dst-port is an optional parameter. Use specify-dst-port yes to enable dst-port for use."/>
    <member name="specify-src-port" guiName="Specify Source Port Range" default="no" type="Union47744" descr="src-port is an optional parameter. Use specify-src-port yes to enable src-port for use."/>
  </tStruct>
  <tStruct typeName="Struct48536" >
    <member name="port-selection" guiName="Port Selection" type="Union48607" descr="Port selection grouping"/>
  </tStruct>
  <tStruct typeName="Struct49221" >
  </tStruct>
  <tStruct typeName="Struct47400" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum47401" descr="What action(s) to perform when alert is triggered"/>
  </tStruct>
  <tStruct typeName="Struct48356" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48028" descr="What action(s) to perform when alert is triggered"/>
    <member name="parameter-tunable-sig" guiName="Parameters Tunable" default="no" type="Union47849" descr="Whether this engine contains tunable parameters."/>
  </tStruct>
  <tStruct typeName="Struct48362" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48028" descr="What action(s) to perform when alert is triggered"/>
  </tStruct>
  <tStruct typeName="Struct47630" >
    <member name="event-action" guiName="Event Action" default="produce-alert" type="Enum48028" descr="What action(s) to perform when alert is triggered"/>
  </tStruct>
  <tStruct typeName="Struct47629" >
    <member name="event-action" guiName="Event Action" type="Enum48453" descr=" "/>
    <member name="swap-attacker-victim" guiName="Swap Attacker Victim" default="false" type="Bool" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)."/>
  </tStruct>
  <tStruct typeName="Struct47666" >
    <member name="storage-key" guiName="Storage Key" type="Enum47983" descr="Type of Address Key used to store persistent data."/>
    <member name="specify-port-range" guiName="Specify Port Range" default="no" type="Union47925" descr="port-range is an optional parameter. Use specify-port-range yes to enable port-range for use."/>
  </tStruct>
  <tStruct typeName="Struct47672" >
    <member name="dst-ports" guiName="Dst Ports" type="IntegerRange0-65535am" descr="Destination ports"/>
    <member name="src-ports" guiName="Src Ports" type="IntegerRange0-65535am" descr="Source ports used in inspection"/>
  </tStruct>
  <tStruct typeName="Struct47732" >
  </tStruct>
  <tStruct typeName="Struct48173" >
    <member name="specify-udp-valid-length" guiName="Specify UDP Valid Length" default="no" type="Union48179" descr="udp-valid-length is an optional parameter. Use specify-udp-valid-length yes to enable udp-valid-length for use."/>
    <member name="specify-udp-length-mismatch" guiName="Specify UDP Length Mismatch" default="no" type="Union48079" descr="udp-length-mismatch is an optional parameter. Use specify-udp-length-mismatch yes to enable udp-length-mismatch for use."/>
    <member name="specify-dst-port" guiName="Specify Destination Port Range" default="no" type="Union48039" descr="dst-port is an optional parameter. Use specify-dst-port yes to enable dst-port for use."/>
    <member name="specify-src-port" guiName="Specify Source Port Range" default="no" type="Union47751" descr="src-port is an optional parameter. Use specify-src-port yes to enable src-port for use."/>
  </tStruct>
  <tStruct typeName="Struct48287" >
    <member name="type" guiName="Type" type="Integer" descr="Type Field of MSRPC packet. 0 = Request; 2 = Response; 11 = Bind; 12 = Bind Ack"/>
    <member name="specify-flags" guiName="Specify Flags" default="no" type="Union47536" descr="flags is an optional parameter. Use specify-flags yes to enable flags for use."/>
  </tStruct>
  <tStruct typeName="Struct48535" >
    <member name="port-selection" guiName="Port Selection" type="Union48607" descr="Port selection grouping"/>
  </tStruct>
  <tStruct typeName="Struct49222" >
  </tStruct>
  <tStruct typeName="Struct47555" >
  </tStruct>
  <tStruct typeName="Struct48443" >
    <member name="length" guiName="Length" type="Integer0-65535" descr="Keys larger than this will fire RSAREF overflow."/>
  </tStruct>
  <tStruct typeName="Struct48640" >
  </tStruct>
  <tStruct typeName="Struct48639" >
    <member name="size-large-packets" guiName="Size of Large Packets" default="1300" type="Integer1-15001300" descr="This is the size of a packet that will be determined to be large by the decoder"/>
    <member name="num-large-packets" guiName="Num Large Packets" default="5" type="Integer1-655355" descr="Number of large packets allowed before decoder becomes suspicious."/>
  </tStruct>
  <tStruct typeName="Struct48527" >
    <member name="unique-attackers" guiName="Unique Attackers" default="1" type="Integer1-2561" descr="Number of unique attackers required per META signature"/>
  </tStruct>
  <tStruct typeName="Struct47405" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer0-65535" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct47409" >
    <member name="min-match-offset" guiName="Min Match Offset" type="Integer1-65535" descr="Minimum offset into packet/stream regex must match at."/>
  </tStruct>
  <tStruct typeName="Struct47412" >
    <member name="max-match-offset" guiName="Max Match Offset" type="Integer1-65535" descr="Maximum number of bytes to inspect."/>
  </tStruct>
  <tStruct typeName="Struct47417" >
    <member name="exact-match-offset" guiName="Exact Match Offset" type="Integer0-65535" descr="The exact stream offset the RegexString must report a match to be valid."/>
  </tStruct>
  <tStruct typeName="Struct47423" >
    <member name="payload-source" guiName="Payload Source" type="Enum47422" descr="Payload source inspection"/>
  </tStruct>
  <tStruct typeName="Struct47427" >
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" default="no" type="Union47418" descr="exact-match-offset is an optional parameter. Use specify-exact-match-offset yes to enable exact-match-offset for use."/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union47406" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
    <member name="specify-payload-source" guiName="Specify Regex Payload Source" default="no" type="Union47424" descr="payload-source is an optional parameter. Use specify-payload-source yes to enable payload-source for use."/>
  </tStruct>
  <tStruct typeName="Struct47437" >
    <member name="scan-interval" guiName="Scan Interval" type="Integer0-131071" descr="Interval used to calculate alarm rates for 3302 and 6255 Alarms. Optional"/>
  </tStruct>
  <tStruct typeName="Struct47441" >
    <member name="type" guiName="MSRPC over SMB PDU Type" type="Integer0-255" descr="Type Field of MSRPC over SMB  packet. 0 = Request; 2 = Response; 11 = Bind; 12 = Bind Ack"/>
  </tStruct>
  <tStruct typeName="Struct47446" >
    <member name="operation" guiName="MSRPC over SMB Operation" type="Integer0-65535" descr="MSRPC over SMB operation requested.  Required for SMB_COM_TRANSACTION commands. Exact match."/>
  </tStruct>
  <tStruct typeName="Struct47452" >
    <member name="direction" guiName="Direction" default="to-service" type="Enum47450" descr="Direction of traffic"/>
  </tStruct>
  <tStruct typeName="Struct47456" >
    <member name="command" guiName="SMB Command" type="Integer0-255" descr="SMB command. Required, Exact match. Currently supporting 37 (0x25) SMB_COM_TRANSACTION command \x26amp; 162 (0xA2) SMB_COM_NT_CREATE_ANDX command."/>
  </tStruct>
  <tStruct typeName="Struct47460" >
    <member name="uuid" guiName="MSRPC over SMB UUID" type="String" descr="MSRPC UUID field"/>
  </tStruct>
  <tStruct typeName="Struct47482" >
    <member name="msrpc-tcp-flags" guiName="MSRPC TCP Flags" type="Enum47481" descr="MSRPC TCP flags"/>
    <member name="msrpc-tcp-flags-mask" guiName="MSRPC TCP Flags Mask" type="Enum47472" descr="MSRPC TCP flags mask"/>
  </tStruct>
  <tStruct typeName="Struct47489" >
    <member name="payload-source" guiName="Payload Source" type="Enum47488" descr="Payload source inspection"/>
  </tStruct>
  <tStruct typeName="Struct47493" >
    <member name="exact-match-offset" guiName="Exact Match Offset" type="Integer0-65535" descr="The exact stream offset the RegexString must report a match to be valid."/>
  </tStruct>
  <tStruct typeName="Struct47496" >
    <member name="max-match-offset" guiName="Max Match Offset" type="Integer1-65535" descr="Maximum number of bytes to inspect."/>
  </tStruct>
  <tStruct typeName="Struct47499" >
    <member name="min-match-offset" guiName="Min Match Offset" type="Integer1-65535" descr="Minimum offset into packet/stream regex must match at."/>
  </tStruct>
  <tStruct typeName="Struct47507" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer0-65535" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct47508" >
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" default="no" type="Union47504" descr="exact-match-offset is an optional parameter. Use specify-exact-match-offset yes to enable exact-match-offset for use."/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union47509" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
    <member name="specify-payload-source" guiName="Specify Regex Payload Source" default="no" type="Union47491" descr="payload-source is an optional parameter. Use specify-payload-source yes to enable payload-source for use."/>
  </tStruct>
  <tStruct typeName="Struct47537" >
    <member name="msrpc-tcp-flags" guiName="MSRPC TCP Flags" type="Enum48314" descr="MSRPC TCP flags"/>
    <member name="msrpc-tcp-flags-mask" guiName="MSRPC TCP Flags Mask" type="Enum47756" descr="MSRPC TCP flags mask"/>
  </tStruct>
  <tStruct typeName="Struct47538" >
    <member name="msrpc-udp-flags" guiName="MSRPC UDP Flags" type="Enum47539" descr="MSRPC UDP flags"/>
    <member name="msrpc-udp-flags-mask" guiName="MSRPC UDP Flags Mask" type="Enum48492" descr="MSRPC UDP flags mask"/>
  </tStruct>
  <tStruct typeName="Struct47552" >
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" default="no" type="Union47548" descr="exact-match-offset is an optional parameter. Use specify-exact-match-offset yes to enable exact-match-offset for use."/>
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union48508" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
  </tStruct>
  <tStruct typeName="Struct47570" >
    <member name="max-fragments" guiName="Max Fragments" default="10000" type="Integer0-4200010000" descr="Maximum number of fragments"/>
  </tStruct>
  <tStruct typeName="Struct47574" >
    <member name="max-dgram-size" guiName="Max Datagram Size" default="65536" type="Integer2000-6553665536" descr="Maximum size of a datagram"/>
  </tStruct>
  <tStruct typeName="Struct47577" >
    <member name="max-partial-dgrams" guiName="Max Partial Datagrams" default="1000" type="Integer0-100001000" descr="Maximum number of partial datagrams"/>
  </tStruct>
  <tStruct typeName="Struct47579" >
    <member name="min-fragment-size" guiName="Min Fragment Size" default="400" type="Integer8-1500400" descr="Minimum fragment size allowed"/>
  </tStruct>
  <tStruct typeName="Struct47581" >
    <member name="max-small-frags" guiName="Max Small Frags" default="2" type="Integer1-82" descr="Maximum number of small fragments"/>
  </tStruct>
  <tStruct typeName="Struct47585" >
    <member name="max-fragments-per-dgram" guiName="Max Fragments per Datagram" default="170" type="Integer0-8192170" descr="Maximum number of fragments allowed per datagram"/>
  </tStruct>
  <tStruct typeName="Struct47588" >
    <member name="fragment-reassembly-timeout" guiName="Fragment Reassembly Timeout" default="60" type="Integer0-36060" descr="Time in seconds before timing out on fragment reassembly."/>
  </tStruct>
  <tStruct typeName="Struct47591" >
    <member name="tcp-idle-timeout" guiName="TCP Idle Timeout" default="3600" type="Integer0-3600003600" descr="Number of seconds of seconds a session can be idle before timeout"/>
  </tStruct>
  <tStruct typeName="Struct47595" >
    <member name="tcp-embryonic-timeout" guiName="TCP Embryonic Timeout" default="30" type="Integer3-30030" descr="Time in seconds to timeout a TCP 3 way handshake"/>
  </tStruct>
  <tStruct typeName="Struct47599" >
    <member name="tcp-closed-timeout" guiName="TCP Closed Timeout" default="5" type="Integer1-605" descr="Number of seconds of seconds a session can be half closed"/>
  </tStruct>
  <tStruct typeName="Struct47601" >
    <member name="tcp-max-queue" guiName="TCP Max Queue" default="32" type="Integer0-12832" descr="Number of out of order packets that can be queued per session"/>
  </tStruct>
  <tStruct typeName="Struct47604" >
    <member name="tcp-option-number" guiName="TCP Option Number" type="IntegerRange0-255am" descr="Number of the TCP option wanted in inspection"/>
  </tStruct>
  <tStruct typeName="Struct47607" >
    <member name="tcp-min-mss" guiName="TCP Min Mss" default="0" type="Integer0-160000" descr="MSS threshold value"/>
  </tStruct>
  <tStruct typeName="Struct47610" >
    <member name="tcp-max-mss" guiName="TCP Max MSS" default="1380" type="Integer0-160001380" descr="MSS threshold value"/>
  </tStruct>
  <tStruct typeName="Struct47634" >
    <member name="exact-match-offset" guiName="Exact Match Offset" type="Integer0-65535" descr="The exact stream offset the RegexString must report a match to be valid."/>
  </tStruct>
  <tStruct typeName="Struct47635" >
    <member name="max-match-offset" guiName="Max Match Offset" type="Integer1-65535" descr="Maximum number of bytes to inspect."/>
  </tStruct>
  <tStruct typeName="Struct47637" >
    <member name="service-ports" guiName="Service Ports" type="IntegerRange0-65535am" descr="A comma separated list of ports or port ranges where the target service may reside"/>
  </tStruct>
  <tStruct typeName="Struct47652" >
    <member name="query-chaos-string" guiName="Query Chaos String" type="String" descr="DNS Query Class Chaos String"/>
  </tStruct>
  <tStruct typeName="Struct47654" >
    <member name="query-class" guiName="Query Class" type="Integer0-65535" descr="DNS Query Class 2 Byte Value"/>
  </tStruct>
  <tStruct typeName="Struct47658" >
    <member name="query-invalid-domain-name" guiName="Query Invalid Domain Name" type="Bool" descr="DNS Query Length >255"/>
  </tStruct>
  <tStruct typeName="Struct47661" >
    <member name="query-jump-count-exceeded" guiName="Query Jump Count Exceeded" type="Bool" descr="DNS compression counter"/>
  </tStruct>
  <tStruct typeName="Struct47664" >
    <member name="query-opcode" guiName="Query Opcode" type="Integer0-65535" descr="DNS Query Opcode 1 byte Value"/>
  </tStruct>
  <tStruct typeName="Struct47678" >
    <member name="src-port" guiName="Src Port" type="Integer0-65535" descr="Source port of interest for this sig."/>
  </tStruct>
  <tStruct typeName="Struct47682" >
    <member name="payload-source" guiName="Payload Source" type="Enum48302" descr="Payload source inspection"/>
  </tStruct>
  <tStruct typeName="Struct47684" >
    <member name="ip-protocol" guiName="Ip Protocol" type="Integer0-255" descr="What IP protocol should this inspector examine?"/>
  </tStruct>
  <tStruct typeName="Struct47687" >
    <member name="dst-port" guiName="Dst Port" type="Integer0-65535" descr="Dest port of interest for this sig."/>
  </tStruct>
  <tStruct typeName="Struct47697" >
    <member name="packet-depth" guiName="Packet Depth" type="Integer0-65535" descr="Number of packets to watch before determining session key was missed."/>
  </tStruct>
  <tStruct typeName="Struct47726" >
    <member name="icmp-type" guiName="ICMP Type" type="Integer0-65535" descr="ICMP header TYPE value"/>
  </tStruct>
  <tStruct typeName="Struct47735" >
    <member name="dst-ip-addr" guiName="Destination IP Address Range" type="IpV4AddrRangeam" descr="Destination IP address"/>
  </tStruct>
  <tStruct typeName="Struct47739" >
    <member name="src-ip-addr" guiName="Source IP Address Range" type="IpV4AddrRangeam" descr="Source IP address"/>
  </tStruct>
  <tStruct typeName="Struct47742" >
    <member name="src-port" guiName="Source Port Range" type="IntegerRange0-65535am" descr="Source port of interest for this sig."/>
  </tStruct>
  <tStruct typeName="Struct47745" >
    <member name="dst-port" guiName="Destination Port Range" type="IntegerRange0-65535am" descr="Dest port of interest for this sig."/>
  </tStruct>
  <tStruct typeName="Struct47748" >
    <member name="src-port" guiName="Source Port Range" type="IntegerRange0-65535am" descr="Source port of interest for this sig."/>
  </tStruct>
  <tStruct typeName="Struct47750" >
    <member name="dst-port" guiName="Destination Port Range" type="IntegerRange0-65535am" descr="Dest port of interest for this sig."/>
  </tStruct>
  <tStruct typeName="Struct47753" >
    <member name="port-map-program" guiName="Port Map Program" type="Integer0-999999999" descr="Program number sent to PortMapper of interest for this sig."/>
  </tStruct>
  <tStruct typeName="Struct47757" >
    <member name="end-match-offset" guiName="Regex End Match Offset" type="Integer0-65535" descr="Offset to match for based on when regex ends its matching"/>
  </tStruct>
  <tStruct typeName="Struct47806" >
    <member name="community-name" guiName="Community Name" type="String" descr="SNMP Community Name"/>
  </tStruct>
  <tStruct typeName="Struct47811" >
    <member name="query-type" guiName="Query Type" type="Integer0-65535" descr="DNS Query Type 2 Byte Value"/>
  </tStruct>
  <tStruct typeName="Struct47813" >
    <member name="rpc-program" guiName="RPC Program" type="Integer0-1000000" descr="Rpc Program Number of interest for this sig."/>
  </tStruct>
  <tStruct typeName="Struct47815" >
    <member name="syn-flood-max-embrionic" guiName="SYN flood max embrionic" default="50" type="Integer10000050" descr="Maximum allowed embrionic connections when determining SYN floods."/>
  </tStruct>
  <tStruct typeName="Struct47820" >
    <member name="request-inbalance" guiName="Request Inbalance" type="Integer0-65535" descr="Number of inbalances in requests"/>
  </tStruct>
  <tStruct typeName="Struct47822" >
    <member name="type-of-arp-sig" guiName="Type Of ARP Sig" type="Enum48186" descr="Type of ARP signature "/>
  </tStruct>
  <tStruct typeName="Struct47826" >
    <member name="rpc-procedure" guiName="RPC Procedure" type="Integer0-1000000" descr="RPC Procedure number of interest for this sig."/>
  </tStruct>
  <tStruct typeName="Struct47842" >
    <member name="min-match-offset" guiName="Min Match Offset" type="Integer1-65535" descr="Minimum offset into packet/stream regex must match at."/>
  </tStruct>
  <tStruct typeName="Struct47860" >
    <member name="min-request-match-length" guiName="Min Request Match Length" type="Integer0-65535" descr="Minimum length for request field."/>
  </tStruct>
  <tStruct typeName="Struct47897" >
    <member name="invalid-packet-index" guiName="Invalid Packet Index" type="Integer0-255" descr="For an ASN Packed Encoding Rule (PER) signature, the parameter is required and the valid range is 1-10.  For a Call Setup signature, field-name, regexp-string, and min-match-length are mutually exclusive with invalid-packet-length. The valid range for invalid-packet-index is 1-6. If the value is 6 (SETUP_STATS_CHK),then there must be a value-range parameter given.  For a TPKT signature, range is 1-7.  For a Q.931 signature, invalid-packet-index mustt be 0 or not present."/>
  </tStruct>
  <tStruct typeName="Struct47901" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct47905" >
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union47903" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
  </tStruct>
  <tStruct typeName="Struct47908" >
    <member name="value-range" guiName="Value Range" type="IntegerRange0-65535" descr="Range of values"/>
  </tStruct>
  <tStruct typeName="Struct47924" >
    <member name="port-range" guiName="Port Range" type="IntegerRange0-65535am" descr="UDP port range used in inscpection"/>
  </tStruct>
  <tStruct typeName="Struct47926" >
    <member name="port-range" guiName="Port Range" type="IntegerRange0-65535am" descr="TCP port range used in inscpection"/>
  </tStruct>
  <tStruct typeName="Struct47936" >
    <member name="icmp-type" guiName="ICMP Type" default="0" type="Integer0-2550" descr="ICMP header TYPE value"/>
  </tStruct>
  <tStruct typeName="Struct47940" >
    <member name="arp-operation" guiName="Arp Operation" type="Integer0-65535" descr="Type of ARP operation to inspect"/>
  </tStruct>
  <tStruct typeName="Struct47942" >
    <member name="query-value" guiName="Query Value" type="Bool" descr="Query 0 Response 1"/>
  </tStruct>
  <tStruct typeName="Struct47945" >
    <member name="port-range" guiName="Port Range" type="IntegerRange1-65535" descr="TCP port range used in inscpection"/>
  </tStruct>
  <tStruct typeName="Struct47952" >
    <member name="global-summary-threshold" guiName="Global Summary Threshold" default="240" type="Integer1-65535240" descr="Threshold number of events to take alert into global summary."/>
  </tStruct>
  <tStruct typeName="Struct47955" >
    <member name="summary-threshold" guiName="Summary Threshold" default="120" type="Integer0-65535120" descr="Threshold number of alert to send signature into summary mode"/>
    <member name="summary-interval" guiName="Summary Interval" default="15" type="Integer1-100015" descr="Time in seconds used in each summary alert"/>
    <member name="specify-global-summary-threshold" guiName="Specify Global Summary Threshold" default="no" type="Union47954" descr="global-summary-threshold is an optional parameter. Use specify-global-summary-threshold yes to enable global-summary-threshold for use."/>
  </tStruct>
  <tStruct typeName="Struct47960" >
    <member name="global-summary-threshold" guiName="Global Summary Threshold" default="240" type="Integer1-65535240" descr="Threshold number of events to take alert into global summary."/>
  </tStruct>
  <tStruct typeName="Struct47965" >
    <member name="global-summary-threshold" guiName="Global Summary Threshold" default="240" type="Integer1-65535240" descr="Threshold number of events to take alert into global summary."/>
    <member name="summary-interval" guiName="Summary Interval" default="15" type="Integer1-6553515" descr="Time in seconds used in each summary alert"/>
  </tStruct>
  <tStruct typeName="Struct47966" >
    <member name="alert-interval" guiName="Alert Interval" default="60" type="Integer2-100060" descr="Time in seconds before event count is reset"/>
  </tStruct>
  <tStruct typeName="Struct47969" >
    <member name="query-stream-len" guiName="Query Stream Len" type="Integer0-65535" descr="DNS Packet Length"/>
  </tStruct>
  <tStruct typeName="Struct47971" >
    <member name="query-record-data-len" guiName="Query Record Data Length" type="Integer0-65535" descr="DNS Response Record Data Length"/>
  </tStruct>
  <tStruct typeName="Struct47974" >
    <member name="rpc-max-length" guiName="RPC Max Length" type="Integer0-65535" descr="Maximum allowed length of whole RPC message.  Lengths longer than this will cause alarm."/>
  </tStruct>
  <tStruct typeName="Struct47977" >
    <member name="query-src-port-53" guiName="Query Src Port 53" type="Bool" descr="DNS packet Src Port 53 "/>
  </tStruct>
  <tStruct typeName="Struct47992" >
    <member name="is-spoof-src" guiName="Is Spoof Src" type="Bool" descr="Fire alarm when the SrcAddress is 127.0.0.1"/>
  </tStruct>
  <tStruct typeName="Struct48002" >
    <member name="mac-flip" guiName="Mac Flip Times" type="Integer0-65535" descr="Flip MAC addresses in alert"/>
  </tStruct>
  <tStruct typeName="Struct48036" >
    <member name="query-record-data-invalid" guiName="Query Record Data Invalid" type="Bool" descr="DNS Record Data incomplete"/>
  </tStruct>
  <tStruct typeName="Struct48043" >
    <member name="tcp-reserved" guiName="TCP Reserved" type="Integer0-63" descr="TCP reserved"/>
  </tStruct>
  <tStruct typeName="Struct48045" >
    <member name="tcp-header-length" guiName="TCP Header Length" type="Integer0-15" descr="Lenght of TCP header used in inscpection"/>
  </tStruct>
  <tStruct typeName="Struct48048" >
    <member name="tcp-payload-length" guiName="TCP Payload Length" type="Integer0-65535" descr="Length of TCP payload "/>
  </tStruct>
  <tStruct typeName="Struct48052" >
    <member name="specify-min-match-length" guiName="Specify Min Match Length" default="no" type="Union48170" descr="min-match-length is an optional parameter. Use specify-min-match-length yes to enable min-match-length for use."/>
    <member name="regex-string" guiName="Regex String" type="Stringaa" descr="A regular expression to search for in a single TCP packet"/>
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" default="no" type="Union48108" descr="exact-match-offset is an optional parameter. Use specify-exact-match-offset yes to enable exact-match-offset for use."/>
  </tStruct>
  <tStruct typeName="Struct48054" >
    <member name="tcp-urg-pointer" guiName="TCP Urgent Pointer" type="Integer0-65535" descr="TCP URG flag inspection"/>
  </tStruct>
  <tStruct typeName="Struct48057" >
    <member name="tcp-window-size" guiName="TCP Window Size" type="Integer0-65535" descr="Window size of TCP packet"/>
  </tStruct>
  <tStruct typeName="Struct48058" >
    <member name="exact-match-offset" guiName="Exact Match Offset" type="Integer0-65535" descr="The exact stream offset the RegexString must report a match to be valid."/>
  </tStruct>
  <tStruct typeName="Struct48062" >
    <member name="icmp-total-length" guiName="ICMP Total Length" type="Integer0-65535" descr="ICMP total length to inspect for"/>
  </tStruct>
  <tStruct typeName="Struct48065" >
    <member name="icmp-id" guiName="ICMP Identifier" type="Integer0-65535" descr="ICMP header IDENTIFIER value"/>
  </tStruct>
  <tStruct typeName="Struct48067" >
    <member name="icmp-code" guiName="ICMP Code" type="IntegerRange0-65535" descr="ICMP header CODE value"/>
  </tStruct>
  <tStruct typeName="Struct48071" >
    <member name="icmp-type" guiName="ICMP Type" type="Integer0-65535" descr="ICMP header TYPE value"/>
  </tStruct>
  <tStruct typeName="Struct48074" >
    <member name="icmp-seq" guiName="ICMP Sequence" type="IntegerRange0-65535" descr="ICMP sequence to inspect for"/>
  </tStruct>
  <tStruct typeName="Struct48075" >
    <member name="l4-protocol" guiName="Layer 4 Protocol" type="Union48447" descr="Layer 4 protocol to inspect for."/>
    <member name="specify-payload-inspection" guiName="Specify Payload Inspection" default="no" type="Union48053" descr="payload-inspection is an optional parameter. Use specify-payload-inspection yes to enable payload-inspection for use."/>
  </tStruct>
  <tStruct typeName="Struct48080" >
    <member name="ip-option-inspection" guiName="IP Option Inspection Options" type="Union48445" descr="IP option inspection"/>
  </tStruct>
  <tStruct typeName="Struct48083" >
    <member name="ip-total-length" guiName="IP Total Length" type="Integer0-65535" descr="Total Length of IP packet to inspect for."/>
  </tStruct>
  <tStruct typeName="Struct48086" >
    <member name="ip-id" guiName="IP Identifier" type="Integer0-255" descr="IP ID to inspect for."/>
  </tStruct>
  <tStruct typeName="Struct48089" >
    <member name="ip-addr-options" guiName="IP Address Options" type="Union48049" descr="IP address options"/>
  </tStruct>
  <tStruct typeName="Struct48091" >
    <member name="ip-version" guiName="IP Version" type="Integer0-16" descr="IP Version inspection"/>
  </tStruct>
  <tStruct typeName="Struct48094" >
    <member name="ip-ttl" guiName="IP Time-to-Live" type="Integer0-255" descr="IP TTL inspection"/>
  </tStruct>
  <tStruct typeName="Struct48097" >
    <member name="ip-tos" guiName="IP Type of Service" type="Integer0-255" descr="IP TOS inspection"/>
  </tStruct>
  <tStruct typeName="Struct48100" >
    <member name="ip-header-length" guiName="IP Header Length" type="Integer0-16" descr="Length of IP header to inspect for."/>
  </tStruct>
  <tStruct typeName="Struct48104" >
    <member name="ip-payload-length" guiName="IP Payload Length" type="IntegerRange0-65535" descr="Length of IP payload to inspect for."/>
  </tStruct>
  <tStruct typeName="Struct48109" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer0-65535" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct48110" >
    <member name="min-match-offset" guiName="Min Match Offset" type="Integer0-65535" descr="Minimum offset into packet/stream regex must match at."/>
  </tStruct>
  <tStruct typeName="Struct48111" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer0-65535" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct48112" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer0-65535" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct48114" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer0-65535" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct48116" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer0-65535" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct48117" >
    <member name="sql-username" guiName="SQL Username" type="String" descr="Username (exact match) of user loging into MS SQL service."/>
  </tStruct>
  <tStruct typeName="Struct48118" >
    <member name="max-uri-field-length" guiName="Max URI Field Length" type="Integer0-65535" descr="Maximum Length of the URI Field."/>
  </tStruct>
  <tStruct typeName="Struct48119" >
    <member name="max-request-field-length" guiName="Max Request Field Length" type="Integer0-65535" descr="Max size of request field length"/>
  </tStruct>
  <tStruct typeName="Struct48120" >
    <member name="max-arg-field-length" guiName="Max Arg Field Length" type="Integer0-65535" descr="Maximum Length of the Arguments Field."/>
  </tStruct>
  <tStruct typeName="Struct48121" >
    <member name="max-header-field-length" guiName="Max Header Field Length" type="Integer0-65535" descr="Maximum Length of the Header Field."/>
  </tStruct>
  <tStruct typeName="Struct48122" >
    <member name="uri-regex" guiName="URI Regex" type="Stringaa" descr="Regular Expression to search in the HTTP URI Field. The URI field is defined to be after the HTTP method (i.e. GET) and before the first CRLF."/>
  </tStruct>
  <tStruct typeName="Struct48123" >
    <member name="header-regex" guiName="Header Regex" type="Stringaa" descr="Regular Expression to search in the HTTP Header Field. The Header is defined after the first CRLF and continues until CRLFCRLF"/>
  </tStruct>
  <tStruct typeName="Struct48124" >
    <member name="arg-value-regex" guiName="Arg Value Regex" type="Stringaa" descr="Regular Expression to search in the HTTP Arguments Field after ArgNameRegex is matched. This performs an ordered match and requires ArgNameRegex to be defined."/>
  </tStruct>
  <tStruct typeName="Struct48134" >
    <member name="regex-end-offset" guiName="Regex End Offset" type="Integer0-65535" descr="Offset of the stream the regular expression is to match on"/>
  </tStruct>
  <tStruct typeName="Struct48136" >
    <member name="regex-min-match-length" guiName="Regex Min Match Length" type="Integer0-65535" descr="Minimum match length for the regular expression."/>
  </tStruct>
  <tStruct typeName="Struct48163" >
    <member name="udp-valid-length" guiName="UDP Valid Length" type="IntegerRange0-65535" descr="UDP packet lengths that are considered valid and should *not* be inspected."/>
  </tStruct>
  <tStruct typeName="Struct48167" >
    <member name="max-match-offset" guiName="Max Match Offset" type="Integer1-65535" descr="Maximum number of bytes to inspect."/>
  </tStruct>
  <tStruct typeName="Struct48222" >
    <member name="arg-name-regex" guiName="Arg Name Regex" type="Stringaa" descr="Regular Expression to search in the HTTP Arguments Field (after the ? and in the Entity body as defined by Content-Length)."/>
    <member name="specify-arg-value-regex" guiName="Specify Arg Value Regex" default="no" type="Union48223" descr="arg-value-regex is an optional parameter. Use specify-arg-value-regex yes to enable arg-value-regex for use."/>
  </tStruct>
  <tStruct typeName="Struct48229" >
    <member name="request-regex" guiName="Request Regex" type="Stringaa" descr="Regular Expression to search in both HTTP URI and HTTP Argument Fields."/>
    <member name="specify-min-request-match-length" guiName="Specify Min Request Match Length" default="no" type="Union48387" descr="min-request-match-length is an optional parameter. Use specify-min-request-match-length yes to enable min-request-match-length for use."/>
  </tStruct>
  <tStruct typeName="Struct48277" >
    <member name="max-match-offset" guiName="Max Match Offset" type="Integer1-65535" descr="Maximum number of bytes to inspect."/>
  </tStruct>
  <tStruct typeName="Struct48364" >
    <member name="inspection-type" guiName="Inspection Type" type="Union48359" descr="Type of inspection to perform"/>
    <member name="want-request" guiName="Want Request" type="Bool" descr="Requests are inspected"/>
    <member name="reply-ratio" guiName="Reply Ratio" type="Integer0-65535" descr="Reply ratio"/>
  </tStruct>
  <tStruct typeName="Struct48409" >
    <member name="max-last-fragments" guiName="Max Last Fragments" default="4" type="Integer1-504" descr="The max last fragments"/>
  </tStruct>
  <tStruct typeName="Struct48439" >
    <member name="object-id" guiName="Object ID" type="String" descr="SNMP Object Identifier"/>
  </tStruct>
  <tStruct typeName="Struct48441" >
    <member name="udp-length-mismatch" guiName="UDP Length Mismatch" default="false" type="Bool" descr="Fire alarm when IP Data length is less than UDP Header Length"/>
  </tStruct>
  <tStruct typeName="Struct48469" >
    <member name="exact-match-offset" guiName="Exact Match Offset" type="Integer0-65535" descr="The exact stream offset the RegexString must report a match to be valid."/>
  </tStruct>
  <tStruct typeName="Struct48472" >
    <member name="min-match-offset" guiName="Min Match Offset" type="Integer1-65535" descr="Minimum offset into packet/stream regex must match at."/>
  </tStruct>
  <tStruct typeName="Struct48485" >
    <member name="operation" guiName="Operation" type="Integer0-65535" descr="MSRPC operation requested.  Required for SMB_COM_TRANSACTION commands. Exact match."/>
  </tStruct>
  <tStruct typeName="Struct48489" >
    <member name="uuid" guiName="UUID" type="String" descr="MSRPC UUID field"/>
  </tStruct>
  <tStruct typeName="Struct48506" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer0-65535" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct48540" >
    <member name="field-name" guiName="Field Name" type="String" descr="Field name to inspect"/>
  </tStruct>
  <tStruct typeName="Struct48563" >
    <member name="byte-count" guiName="Byte Count" type="Integer0-65535" descr="Byte Count from SMB_COM_TRANSACTION structure. Optional; Exact match"/>
  </tStruct>
  <tStruct typeName="Struct48566" >
    <member name="file-id" guiName="File ID" type="Integer0-65535" descr="Transaction File ID.  Note that this parameter may limit a signature to a specific exploit instance and its use should be carefully considered.  Optional; Exact Match"/>
  </tStruct>
  <tStruct typeName="Struct48569" >
    <member name="hit-count" guiName="Hit Count" type="Integer0-65535" descr="Threshold number of occurances in ScanInterval to fire alarms for 3302 and 6255"/>
  </tStruct>
  <tStruct typeName="Struct48572" >
    <member name="scan-interval" guiName="Scan Interval" type="Integer0-131071" descr="Interval used to calculate alarm rates for 3302 and 6255 Alarms. Optional"/>
  </tStruct>
  <tStruct typeName="Struct48576" >
    <member name="word-count" guiName="Word Count" type="Integer0-255" descr="Word count for command parameters. Required, exact match. (SMB_COM_TRANSACTION) - Only 16 word transactions are decoded."/>
  </tStruct>
  <tStruct typeName="Struct48579" >
    <member name="type" guiName="Type" type="Integer0-255" descr="Type Field of MSRPC packet. 0 = Request; 2 = Response; 11 = Bind; 12 = Bind Ack"/>
  </tStruct>
  <tStruct typeName="Struct48582" >
    <member name="set-count" guiName="Set Count" type="Integer0-255" descr="Number of Setup words. Required; Exact match. Normally two for SMB_COM_TRANSACTION commands."/>
  </tStruct>
  <tStruct typeName="Struct48585" >
    <member name="resource" guiName="Resource" type="String" descr="Pipe or SMB File name used to qualify alarm. ASCII; Required; Exact match."/>
  </tStruct>
  <tStruct typeName="Struct48588" >
    <member name="operation" guiName="Operation" type="Integer0-65535" descr="MSRPC operation requested.  Required for SMB_COM_TRANSACTION commands. Exact match."/>
  </tStruct>
  <tStruct typeName="Struct48591" >
    <member name="function" guiName="Function" type="Integer0-65535" descr="Named Pipe function.(SMB_COM_TRANSACTION) - Required; Exact match."/>
  </tStruct>
  <tStruct typeName="Struct48594" >
    <member name="direction" guiName="Direction" default="to-service" type="Enum48548" descr="Direction of traffic"/>
  </tStruct>
  <tStruct typeName="Struct48597" >
    <member name="command" guiName="Command" type="Integer0-255" descr="SMB command. Required, Exact match. Currently supporting 37 (0x25) SMB_COM_TRANSACTION command \x26amp; 162 (0xA2) SMB_COM_NT_CREATE_ANDX command."/>
  </tStruct>
  <tStruct typeName="Struct48600" >
    <member name="allocation-hint" guiName="Allocation Hint" type="Integer0-4294967295" descr="MSRPC Allocation Hint.  Used in SMB_COM_TRANSACTION command parsing. Optional; Exact match. "/>
  </tStruct>
  <tStruct typeName="Struct48629" >
    <member name="hijack-max-old-ack" guiName="Max Old ACK" default="200" type="Integer0-65535200" descr="Maximum amount of old ACK before determining a hijack session50"/>
  </tStruct>
  <tStruct typeName="Struct48653" >
    <member name="specify-exact-match-offset" guiName="Specify Exact Match Offset" type="Union48108" descr=" "/>
    <member name="regex-string" guiName="Regex String" type="String" descr=" "/>
    <member name="specify-min-match-length" guiName="Specify Min Match Length" type="Union48170" descr=" "/>
  </tStruct>
  <tStruct typeName="Struct48668" >
    <member name="src-addr-filter" guiName="src-addr-filter" type="IpV4AddrRangeam" descr="Src Addr Filter"/>
  </tStruct>
  <tStruct typeName="Struct48671" >
    <member name="dst-addr-filter" guiName="dst-addr-filter" type="IpV4AddrRangeam" descr="Dst Addr Filter"/>
  </tStruct>
  <tStruct typeName="Struct48729" >
    <member name="mars-category" guiName="MARS Category" default="Info/Misc" type="Enum48726" descr="Categories used by the MARS software"/>
  </tStruct>
  <tStruct typeName="Struct49074" >
    <member name="regex-string" guiName="Regex String" type="String" descr="Regular expresion string applied to the regex command."/>
  </tStruct>
  <tStruct typeName="Struct49097" >
    <member name="exact-match-offset" guiName="Exact Match Offset" type="Integer0-250" descr="The exact stream offset the RegexString must report a match to be valid."/>
  </tStruct>
  <tStruct typeName="Struct49101" >
    <member name="min-match-offset" guiName="Min Match Offset" type="Integer0-250" descr="Minimum offset into packet/stream regex must match at."/>
  </tStruct>
  <tStruct typeName="Struct49105" >
    <member name="max-match-offset" guiName="Max Match Offset" type="Integer0-250" descr="Maximum depth of match offset."/>
  </tStruct>
  <tStruct typeName="Struct49110" >
    <member name="icmp-type" guiName="ICMP Type" default="18" type="IntegerRange0-18am18" descr="ICMP header TYPE value to exclude from alert"/>
  </tStruct>
  <tStruct typeName="Struct49113" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer1-250" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct49142" >
    <member name="exact-match-offset" guiName="Exact Match Offset" type="Integer0-250" descr="The exact stream offset the RegexString must report a match to be valid."/>
  </tStruct>
  <tStruct typeName="Struct49146" >
    <member name="min-match-offset" guiName="Min Match Offset" type="Integer0-250" descr="Minimum offset into packet/stream regex must match at."/>
  </tStruct>
  <tStruct typeName="Struct49150" >
    <member name="max-match-offset" guiName="Max Match Offset" type="Integer0-250" descr="Maximum depth of match"/>
  </tStruct>
  <tStruct typeName="Struct49154" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer1-250" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct49161" >
    <member name="service-ports" guiName="Service Ports" type="IntegerRange0-65535am" descr="A comma separated list of ports or port ranges to exclude from alert."/>
  </tStruct>
  <tStruct typeName="Struct49181" >
    <member name="exact-match-offset" guiName="Exact Match Offset" type="Integer0-250" descr="The exact stream offset the RegexString must report a match to be valid."/>
  </tStruct>
  <tStruct typeName="Struct49185" >
    <member name="min-match-offset" guiName="Min Match Offset" type="Integer0-250" descr="Minimum offset into packet/stream regex must match at."/>
  </tStruct>
  <tStruct typeName="Struct49189" >
    <member name="max-match-offset" guiName="Max Match Offset" type="Integer0-250" descr="Maximum depth of match offset."/>
  </tStruct>
  <tStruct typeName="Struct49193" >
    <member name="min-match-length" guiName="Min Match Length" type="Integer1-250" descr="Minimum number of bytes the RegexString must match."/>
  </tStruct>
  <tStruct typeName="Struct49199" >
    <member name="service-ports" guiName="Service Ports" type="IntegerRange0-65535am" descr="A comma separated list of ports or port ranges to exclude from alert."/>
  </tStruct>
  <tUnion typeName="Union48623">
    <member name="content-verification" guiName="Content Verification" type="Struct47758" descr="content-verification"/>
    <member name="length" guiName="Length" type="IntegerRange0-65535" descr="Values not in the range will cause this sig to fire."/>
    <member name="no-additional-details" guiName="No Additional Details" type="Struct47759" descr="no-additional-details"/>
  </tUnion>
  <tUnion typeName="Union47762">
    <member name="define-content-type" guiName="Define Content Type" type="Struct47833" descr="define-content-type"/>
    <member name="define-recognized-content-types" guiName="Define Recognized Content Types" type="Struct48380" descr="define-recognized-content-types"/>
  </tUnion>
  <tUnion typeName="Union48004" protected="true" >
    <member name="default-signatures-only" guiName="Default Signatures Only" type="Struct47527" descr="Default signatures"/>
    <member name="no-custom-signatures" guiName="No Custom Signatures" type="Struct48003" descr="Custom signatures not permited"/>
  </tUnion>
  <tUnion typeName="Union48434">
    <member name="application-policy-enforcement-ftp" guiName="AIC FTP" version="2005-05-16" type="Struct47922" descr="Signature engine"/>
    <member name="application-policy-enforcement-http" guiName="AIC HTTP" version="2005-07-01" type="Struct48152" descr="Signature engine"/>
    <member name="atomic-arp" guiName="Atomic ARP" version="2005-01-14" type="Struct48183" descr="Signature engine"/>
    <member name="atomic-ip" guiName="Atomic IP" version="2006-02-12" type="Struct48433" descr="Signature engine"/>
    <member name="atomic-ip-v6" guiName="Atomic IPv6" version="2005-09-12" type="Struct48710" descr="atomic-ip-v6"/>
    <member name="fixed-icmp" guiName="Fixed ICMP" version="" type="Struct49078" descr="Fixed ICMP inspection Engine"/>
    <member name="fixed-tcp" guiName="Fixed TCP" version="" type="Struct49079" descr="Fixed Inspection Depth Engine for TCP"/>
    <member name="fixed-udp" guiName="Fixed UDP" version="" type="Struct49080" descr="Fixed Depth Inspection Engine for UDP"/>
    <member name="flood-host" guiName="Flood Host" version="2006-12-18" type="Struct48192" descr="Signature engine"/>
    <member name="flood-net" guiName="Flood Net" version="2005-04-25" type="Struct48195" descr="Signature engine"/>
    <member name="meta" guiName="Meta" version="2005-07-01" type="Struct48511" descr="Signature engine"/>
    <member name="multi-string" guiName="Multi String" version="2005-05-04" type="Struct48542" descr="Signature engine"/>
    <member name="normalizer" guiName="Normalizer" version="2006-07-26" type="Struct47628" descr="Signature engine"/>
    <member name="service-dns" guiName="Service DNS" version="2006-02-12" type="Struct48037" descr="Signature engine"/>
    <member name="service-ftp" guiName="Service FTP" version="2005-01-14" type="Struct48211" descr="Signature engine"/>
    <member name="service-generic" guiName="Service Generic" version="2006-12-18" type="Struct48365" descr="Signature engine"/>
    <member name="service-h225" guiName="Service H225" version="2006-02-12" type="Struct48149" descr="Signature engine"/>
    <member name="service-http" guiName="Service HTTP" version="2005-01-14" type="Struct48217" descr="Signature engine"/>
    <member name="service-ident" guiName="Service Ident" version="2005-01-14" type="Struct48252" descr="Signature engine"/>
    <member name="service-msrpc" guiName="Service MSRPC" version="2006-02-12" type="Struct48023" descr="Signature engine"/>
    <member name="service-mssql" guiName="Service MSSQL" version="2005-01-14" type="Struct48260" descr="Signature engine"/>
    <member name="service-ntp" guiName="Service NTP" version="2005-01-14" type="Struct48199" descr="Signature engine"/>
    <member name="service-p2p" guiName="Service P2P" version="" type="Struct49201" descr="Peer-to-Peer Engine with built-in signatures"/>
    <member name="service-rpc" guiName="Service RPC" version="2006-02-12" type="Struct48272" descr="Signature engine"/>
    <member name="service-smb" guiName="Service SMB" version="2005-03-31" type="Struct48534" descr="Signature engine"/>
    <member name="service-smb-advanced" guiName="Service SMB Advanced" version="2005-12-15" type="Struct47510" descr="Signature engine"/>
    <member name="service-snmp" guiName="Service SNMP" version="2006-12-18" type="Struct48289" descr="Signature engine"/>
    <member name="service-ssh" guiName="Service SSH" version="2005-01-14" type="Struct48297" descr="Signature engine"/>
    <member name="service-tns" guiName="Service TNS" version="2005-12-02" type="Struct47433" descr="Signature engine"/>
    <member name="state" guiName="State" version="2005-01-14" type="Struct48303" descr="Signature engine"/>
    <member name="string-icmp" guiName="String ICMP" version="2006-12-18" type="Struct48326" descr="Signature engine"/>
    <member name="string-tcp" guiName="String TCP" version="2005-09-12" type="Struct48337" descr="Signature engine"/>
    <member name="string-udp" guiName="String UDP" version="2005-11-23" type="Struct48347" descr="Signature engine"/>
    <member name="sweep" guiName="Sweep" version="2006-12-18" type="Struct48155" descr="Signature engine"/>
    <member name="sweep-other-tcp" guiName="Sweep Other TCP" version="2005-07-10" type="Struct48372" descr="Signature engine"/>
    <member name="traffic-anomaly" guiName="Traffic Anomaly" version="2006-02-12" type="Struct47400" descr="Traffic Anomaly ENGINE"/>
    <member name="traffic-icmp" guiName="Traffic ICMP" version="2005-01-14" type="Struct48356" descr="Signature engine"/>
    <member name="trojan-bo2k" guiName="Trojan Bo2k" version="2005-01-14" type="Struct48362" descr="Signature engine"/>
    <member name="trojan-tfn2k" guiName="Trojan Tfn2k" version="2005-01-14" type="Struct47630" descr="Signature engine"/>
    <member name="trojan-udp" guiName="Trojan UDP" version="2005-01-14" type="Struct47629" descr="Signature engine"/>
  </tUnion>
  <tUnion typeName="Union48676">
    <member name="none" guiName="None" type="Struct48677" descr="No rate limiting configured."/>
    <member name="percentage" guiName="Percentage" type="Struct48678" descr="Rate limit by traffic percentage."/>
  </tUnion>
  <tUnion typeName="Union48020">
    <member name="inspect-ntp-packets" guiName="Inspect NTP Packets" type="Struct48266" descr="Inspection for NTP packets"/>
    <member name="is-invalid-data-packet" guiName="Is Invalid Data Packet" type="Struct48267" descr="Inspection for invalid NTP data packets"/>
    <member name="is-non-ntp-traffic" guiName="Is Non NTP Traffic" type="Struct48268" descr="Inspection for non-NTP packets"/>
  </tUnion>
  <tUnion typeName="Union48257">
    <member name="has-bad-port" guiName="Has Bad Port" type="Struct48259" descr="Inspection for a bad port."/>
    <member name="has-newline" guiName="Has Newline" type="Struct48258" descr="Inspection for a new line."/>
    <member name="size" guiName="Payload Size" type="Struct48021" descr="Size used in inspection"/>
  </tUnion>
  <tUnion typeName="Union48290">
    <member name="brute-force-inspection" guiName="Brute Force Inspection" type="Struct48293" descr="Inspect for brute force attempts"/>
    <member name="invalid-packet-inspection" guiName="Invalid Packet Inspection" type="Struct48291" descr="Inspection for invalid SNMP packets."/>
    <member name="non-snmp-traffic-inspection" guiName="Non-SNMP Traffic Inspection" type="Struct48292" descr="Inspection for non-SNMP traffic"/>
    <member name="snmp-inspection" guiName="SNMP Inspection" type="Struct48295" descr="SNMP inspection"/>
  </tUnion>
  <tUnion typeName="Union48359">
    <member name="is-loki" guiName="Original Loki" type="Struct48360" descr="Inspection for LOKI traffic"/>
    <member name="is-mod-loki" guiName="Modified Loki" type="Struct48361" descr="Inspection for MOD-LOKI traffic"/>
  </tUnion>
  <tUnion typeName="Union48049">
    <member name="address-with-localhost" guiName="Address With Localhost" type="Struct47995" descr="IP address with 127.0.0.1"/>
    <member name="ip-addr" guiName="IP Addresses" type="Struct48041" descr="IP address"/>
    <member name="rfc-1918-address" guiName="RFC 1918 Address" type="Struct47994" descr="Inspection for an RPC 1918 IP address"/>
    <member name="src-ip-eq-dst-ip" guiName="Src IP Equal Dst IP" type="Struct47829" descr="Source and Destination addresses are same"/>
  </tUnion>
  <tUnion typeName="Union48445">
    <member name="ip-option" guiName="IP Option" type="Integer0-65535" descr="IP OPTION Code to match."/>
    <member name="ip-option-abnormal" guiName="IP Option Abnormal Options" type="Bool" descr="The list of options is malformed."/>
  </tUnion>
  <tUnion typeName="Union48447">
    <member name="icmp" guiName="ICMP Protocol" type="Struct48176" descr="ICMP protocol"/>
    <member name="other-protocol" guiName="Other IP Protocols" type="Struct48451" descr="Number for other protocol"/>
    <member name="tcp" guiName="TCP Protocol" type="Struct48450" descr="TCP protocol"/>
    <member name="udp" guiName="UDP Protocol" type="Struct48173" descr="UDP protocol"/>
  </tUnion>
  <tUnion typeName="Union48444">
    <member name="key-length" guiName="Key Length" type="Struct48603" descr="Length of SSH key to inspect for."/>
    <member name="user-length" guiName="User Length" type="Struct48443" descr="User length SSH inspection"/>
  </tUnion>
  <tUnion typeName="Union48525">
    <member name="AaBb" guiName="Attacker and victim addresses and ports" type="Struct48529" descr="Attacker and victim addresses and ports"/>
    <member name="AxBx" guiName="Attacker and victim addresses" type="Struct48528" descr="Attacker and victim addresses"/>
    <member name="Axxx" guiName="Attacker address" type="Struct48526" descr="Attacker address"/>
    <member name="xxBx" guiName="Victim address" type="Struct48527" descr="Victim address"/>
  </tUnion>
  <tUnion typeName="Union47849" protected="true" >
    <member name="no" guiName="No" type="Struct47848" descr="This engine does not have tunable parameters"/>
    <member name="yes" guiName="Yes" type="Struct48364" descr="Parameter is tunable"/>
  </tUnion>
  <tUnion typeName="Union48607">
    <member name="both-ports" guiName="Both Ports" type="Struct47824" descr="Inspect port sets or ports"/>
    <member name="destination" guiName="Destination" type="Struct48646" descr=" "/>
    <member name="source" guiName="Source" type="Struct48647" descr=" "/>
  </tUnion>
  <tUnion typeName="Union47668">
    <member name="icmp" guiName="ICMP" type="Struct47667" descr="ICMP protocol"/>
    <member name="tcp" guiName="TCP" type="Struct47669" descr="TCP protocol"/>
    <member name="udp" guiName="UDP" type="Struct47666" descr="UDP protocol"/>
  </tUnion>
  <tUnion typeName="Union47674">
    <member name="icmp" guiName="ICMP" type="Struct47673" descr="ICMP protocol"/>
    <member name="udp" guiName="UDP" type="Struct47672" descr="UDP protocol"/>
  </tUnion>
  <tUnion typeName="Union47804">
    <member name="icmp" guiName="ICMP" type="Struct47805" descr="ICMP protocol"/>
    <member name="tcp" guiName="TCP" type="Struct47807" descr="TCP protocol"/>
    <member name="udp" guiName="UDP" type="Struct47732" descr="UDP protocol"/>
  </tUnion>
  <tUnion typeName="Union48022">
    <member name="tcp" guiName="TCP" type="Struct47774" descr="TCP protocol"/>
    <member name="udp" guiName="UDP" type="Struct48287" descr="UDP protocol"/>
  </tUnion>
  <tUnion typeName="Union48543">
    <member name="icmp" guiName="Icmp" type="Struct48537" descr="ICMP protocol"/>
    <member name="tcp" guiName="Tcp" type="Struct48536" descr="TCP protocol"/>
    <member name="udp" guiName="Udp" type="Struct48535" descr="UDP protocol"/>
  </tUnion>
  <tUnion typeName="Union49220">
    <member name="tcp" guiName="TCP" type="Struct49221" descr=" "/>
    <member name="udp" guiName="UDP" type="Struct49222" descr=" "/>
  </tUnion>
  <tUnion typeName="Union47832">
    <member name="define-request-method" guiName="Define Request Method" type="String" descr="define-request-method"/>
    <member name="recognized-request-methods" guiName="Recognized Request Methods" type="List47731" descr="recognized-request-method"/>
  </tUnion>
  <tUnion typeName="Union48153">
    <member name="content-types" guiName="Content Types" type="Union47762" descr="content-types"/>
    <member name="define-web-traffic-policy" guiName="Define Web Traffic Policy" type="Struct48150" descr="define-web-traffic-policy"/>
    <member name="max-outstanding-requests-overrun" guiName="Max Outstanding Requests Overrun" type="Struct48541" descr="Inspection for large number of outstanding HTTP requests"/>
    <member name="msg-body-pattern" guiName="Msg Body Pattern" type="Struct48146" descr="msg-body-pattern"/>
    <member name="request-methods" guiName="Request Methods" type="Union47832" descr="Signature types that deal with request methods"/>
    <member name="transfer-encodings" guiName="Transfer Encodings" type="Union47767" descr="Signature types that deal with transfer encodings"/>
  </tUnion>
  <tUnion typeName="Union48533">
    <member name="ftp-commands" guiName="FTP Commands" type="Struct47592" descr="FTP commands inspection."/>
    <member name="unrecognized-ftp-command" guiName="Unrecognized FTP Command" type="Struct47555" descr="Inspection for unrecognized FTP command"/>
  </tUnion>
  <tUnion typeName="Union48617">
    <member name="exact" guiName="Exact" type="Struct48648" descr=" "/>
    <member name="minimum" guiName="Minimum" type="Struct48649" descr=" "/>
  </tUnion>
  <tUnion typeName="Union48388">
    <member name="no" guiName="No" type="Struct47968" descr="Disable the paramter, alert-interval, from use."/>
    <member name="yes" guiName="Yes" type="Struct47966" descr="Enable the parameter, alert-interval, for use."/>
  </tUnion>
  <tUnion typeName="Union48598">
    <member name="no" guiName="No" type="Struct48599" descr="Disable the paramter, allocation-hint, from use."/>
    <member name="yes" guiName="Yes" type="Struct48600" descr="Enable the parameter, allocation-hint, for use."/>
  </tUnion>
  <tUnion typeName="Union48220">
    <member name="no" guiName="No" type="Struct48221" descr="Disable the paramter, arg-name-regex, from use."/>
    <member name="yes" guiName="Yes" type="Struct48222" descr="Enable the parameter, arg-name-regex, for use."/>
  </tUnion>
  <tUnion typeName="Union48223">
    <member name="no" guiName="No" type="Struct48224" descr="Disable the paramter, arg-value-regex, from use."/>
    <member name="yes" guiName="Yes" type="Struct48124" descr="Enable the parameter, arg-value-regex, for use."/>
  </tUnion>
  <tUnion typeName="Union47802">
    <member name="no" guiName="No" type="Struct47941" descr="Disable the paramter, arp-operation, from use."/>
    <member name="yes" guiName="Yes" type="Struct47940" descr="Enable the parameter, arp-operation, for use."/>
  </tUnion>
  <tUnion typeName="Union48561">
    <member name="no" guiName="No" type="Struct48562" descr="Disable the paramter, byte-count, from use."/>
    <member name="yes" guiName="Yes" type="Struct48563" descr="Enable the parameter, byte-count, for use."/>
  </tUnion>
  <tUnion typeName="Union47458">
    <member name="no" guiName="No" type="Struct47455" descr="Disable the paramter, command, from use."/>
    <member name="yes" guiName="Yes" type="Struct47456" descr="Enable the parameter, command, for use."/>
  </tUnion>
  <tUnion typeName="Union48595">
    <member name="no" guiName="No" type="Struct48596" descr="Disable the paramter, command, from use."/>
    <member name="yes" guiName="Yes" type="Struct48597" descr="Enable the parameter, command, for use."/>
  </tUnion>
  <tUnion typeName="Union47846">
    <member name="no" guiName="No" type="Struct47845" descr="Disable the paramter, community-name, from use."/>
    <member name="yes" guiName="Yes" type="Struct47806" descr="Enable the parameter, community-name, for use."/>
  </tUnion>
  <tUnion typeName="Union47453">
    <member name="no" guiName="No" type="Struct47451" descr="Disable the paramter, direction, from use."/>
    <member name="yes" guiName="Yes" type="Struct47452" descr="Enable the parameter, direction, for use."/>
  </tUnion>
  <tUnion typeName="Union48592">
    <member name="no" guiName="No" type="Struct48593" descr="Disable the paramter, direction, from use."/>
    <member name="yes" guiName="Yes" type="Struct48594" descr="Enable the parameter, direction, for use."/>
  </tUnion>
  <tUnion typeName="Union48670">
    <member name="no" guiName="No" type="Struct48673" descr=" "/>
    <member name="yes" guiName="Yes" type="Struct48671" descr=" "/>
  </tUnion>
  <tUnion typeName="Union47737">
    <member name="no" guiName="No" type="Struct47736" descr="Disable the paramter, dst-ip-addr, from use."/>
    <member name="yes" guiName="Yes" type="Struct47735" descr="Enable the parameter, dst-ip-addr, for use."/>
  </tUnion>
  <tUnion typeName="Union47689">
    <member name="no" guiName="No" type="Struct47688" descr="Disable the paramter, dst-port, from use."/>
    <member name="yes" guiName="Yes" type="Struct47687" descr="Enable the parameter, dst-port, for use."/>
  </tUnion>
  <tUnion typeName="Union47747">
    <member name="no" guiName="No" type="Struct47746" descr="Disable the paramter, dst-port, from use."/>
    <member name="yes" guiName="Yes" type="Struct47745" descr="Enable the parameter, dst-port, for use."/>
  </tUnion>
  <tUnion typeName="Union48039">
    <member name="no" guiName="No" type="Struct47827" descr="Disable the paramter, dst-port, from use."/>
    <member name="yes" guiName="Yes" type="Struct47750" descr="Enable the parameter, dst-port, for use."/>
  </tUnion>
  <tUnion typeName="Union47831">
    <member name="no" guiName="No" type="Struct47773" descr="Disable the paramter, end-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct47757" descr="Enable the parameter, end-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union47418">
    <member name="no" guiName="No" type="Struct47414" descr="Disable the paramter, exact-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct47417" descr="Enable the parameter, exact-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union47504">
    <member name="no" guiName="No" type="Struct47503" descr="Disable the paramter, exact-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct47493" descr="Enable the parameter, exact-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union47548">
    <member name="no" guiName="No" type="Struct47547" descr="Disable the paramter, exact-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct48469" descr="Enable the parameter, exact-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union48108">
    <member name="no" guiName="No" type="Struct48165" descr="Disable the paramter, exact-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct48058" descr="Enable the parameter, exact-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union48113">
    <member name="no" guiName="No" type="Struct48341" descr="Disable the paramter, exact-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct47634" descr="Enable the parameter, exact-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union49096">
    <member name="no" guiName="No" type="Struct49099" descr="Disable the paramter, exact-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct49097" descr="Enable the parameter, exact-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union49141">
    <member name="no" guiName="No" type="Struct49144" descr="Disable the paramter, exact-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct49142" descr="Enable the parameter, exact-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union49180">
    <member name="no" guiName="No" type="Struct49183" descr="Disable the paramter, exact-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct49181" descr="Enable the parameter, exact-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union48363">
    <member name="no" guiName="No" type="Struct48539" descr="Disable the paramter, field-name, from use."/>
    <member name="yes" guiName="Yes" type="Struct48540" descr="Enable the parameter, field-name, for use."/>
  </tUnion>
  <tUnion typeName="Union48564">
    <member name="no" guiName="No" type="Struct48565" descr="Disable the paramter, file-id, from use."/>
    <member name="yes" guiName="Yes" type="Struct48566" descr="Enable the parameter, file-id, for use."/>
  </tUnion>
  <tUnion typeName="Union47535">
    <member name="no" guiName="No" type="Struct47534" descr="Disable the paramter, flags, from use."/>
    <member name="yes" guiName="Yes" type="Struct47537" descr="Enable the parameter, flags, for use."/>
  </tUnion>
  <tUnion typeName="Union47536">
    <member name="no" guiName="No" type="Struct48517" descr="Disable the paramter, flags, from use."/>
    <member name="yes" guiName="Yes" type="Struct47538" descr="Enable the parameter, flags, for use."/>
  </tUnion>
  <tUnion typeName="Union47590" protected="true" >
    <member name="no" guiName="No" type="Struct47589" descr="Disable the paramter, fragment-reassembly-timeout, from use."/>
    <member name="yes" guiName="Yes" type="Struct47588" descr="Enable the parameter, fragment-reassembly-timeout, for use."/>
  </tUnion>
  <tUnion typeName="Union48589">
    <member name="no" guiName="No" type="Struct48590" descr="Disable the paramter, function, from use."/>
    <member name="yes" guiName="Yes" type="Struct48591" descr="Enable the parameter, function, for use."/>
  </tUnion>
  <tUnion typeName="Union47949">
    <member name="no" guiName="No" type="Struct47963" descr="Disable the paramter, global-summary-threshold, from use."/>
    <member name="yes" guiName="Yes" type="Struct47965" descr="Enable the parameter, global-summary-threshold, for use."/>
  </tUnion>
  <tUnion typeName="Union47954">
    <member name="no" guiName="No" type="Struct47950" descr="Disable the paramter, global-summary-threshold, from use."/>
    <member name="yes" guiName="Yes" type="Struct47952" descr="Enable the parameter, global-summary-threshold, for use."/>
  </tUnion>
  <tUnion typeName="Union47962">
    <member name="no" guiName="No" type="Struct47959" descr="Disable the paramter, global-summary-threshold, from use."/>
    <member name="yes" guiName="Yes" type="Struct47960" descr="Enable the parameter, global-summary-threshold, for use."/>
  </tUnion>
  <tUnion typeName="Union48231">
    <member name="no" guiName="No" type="Struct48230" descr="Disable the paramter, header-regex, from use."/>
    <member name="yes" guiName="Yes" type="Struct48123" descr="Enable the parameter, header-regex, for use."/>
  </tUnion>
  <tUnion typeName="Union47524" protected="true" >
    <member name="no" guiName="No" type="Struct48630" descr="Disable the paramter, hijack-max-old-ack, from use."/>
    <member name="yes" guiName="Yes" type="Struct48629" descr="Enable the parameter, hijack-max-old-ack, for use."/>
  </tUnion>
  <tUnion typeName="Union48567">
    <member name="no" guiName="No" type="Struct48568" descr="Disable the paramter, hit-count, from use."/>
    <member name="yes" guiName="Yes" type="Struct48569" descr="Enable the parameter, hit-count, for use."/>
  </tUnion>
  <tUnion typeName="Union48070">
    <member name="no" guiName="No" type="Struct48069" descr="Disable the paramter, icmp-code, from use."/>
    <member name="yes" guiName="Yes" type="Struct48067" descr="Enable the parameter, icmp-code, for use."/>
  </tUnion>
  <tUnion typeName="Union48068">
    <member name="no" guiName="No" type="Struct48066" descr="Disable the paramter, icmp-id, from use."/>
    <member name="yes" guiName="Yes" type="Struct48065" descr="Enable the parameter, icmp-id, for use."/>
  </tUnion>
  <tUnion typeName="Union48103">
    <member name="no" guiName="No" type="Struct48107" descr="Disable the paramter, icmp-seq, from use."/>
    <member name="yes" guiName="Yes" type="Struct48074" descr="Enable the parameter, icmp-seq, for use."/>
  </tUnion>
  <tUnion typeName="Union48064">
    <member name="no" guiName="No" type="Struct48063" descr="Disable the paramter, icmp-total-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48062" descr="Enable the parameter, icmp-total-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47728">
    <member name="no" guiName="No" type="Struct47727" descr="Disable the paramter, icmp-type, from use."/>
    <member name="yes" guiName="Yes" type="Struct47726" descr="Enable the parameter, icmp-type, for use."/>
  </tUnion>
  <tUnion typeName="Union47937">
    <member name="no" guiName="No" type="Struct47934" descr="Disable the paramter, icmp-type, from use."/>
    <member name="yes" guiName="Yes" type="Struct47936" descr="Enable the parameter, icmp-type, for use."/>
  </tUnion>
  <tUnion typeName="Union48073">
    <member name="no" guiName="No" type="Struct48072" descr="Disable the paramter, icmp-type, from use."/>
    <member name="yes" guiName="Yes" type="Struct48071" descr="Enable the parameter, icmp-type, for use."/>
  </tUnion>
  <tUnion typeName="Union49108">
    <member name="no" guiName="No" type="Struct49109" descr=" "/>
    <member name="yes" guiName="Yes" type="Struct49110" descr="Enable the parameter, icmp-type, to exclude types"/>
  </tUnion>
  <tUnion typeName="Union47900">
    <member name="no" guiName="No" type="Struct47899" descr="Disable the paramter, invalid-packet-index, from use."/>
    <member name="yes" guiName="Yes" type="Struct47897" descr="Enable the parameter, invalid-packet-index, for use."/>
  </tUnion>
  <tUnion typeName="Union47828">
    <member name="no" guiName="No" type="Struct48090" descr="Disable the paramter, ip-addr-options, from use."/>
    <member name="yes" guiName="Yes" type="Struct48089" descr="Enable the parameter, ip-addr-options, for use."/>
  </tUnion>
  <tUnion typeName="Union48102">
    <member name="no" guiName="No" type="Struct48101" descr="Disable the paramter, ip-header-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48100" descr="Enable the parameter, ip-header-length, for use."/>
  </tUnion>
  <tUnion typeName="Union48088">
    <member name="no" guiName="No" type="Struct48087" descr="Disable the paramter, ip-id, from use."/>
    <member name="yes" guiName="Yes" type="Struct48086" descr="Enable the parameter, ip-id, for use."/>
  </tUnion>
  <tUnion typeName="Union48082">
    <member name="no" guiName="No" type="Struct48081" descr="Disable the paramter, ip-option-inspection, from use."/>
    <member name="yes" guiName="Yes" type="Struct48080" descr="Enable the parameter, ip-option-inspection, for use."/>
  </tUnion>
  <tUnion typeName="Union48446">
    <member name="no" guiName="No" type="Struct48105" descr="Disable the paramter, ip-payload-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48104" descr="Enable the parameter, ip-payload-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47686">
    <member name="no" guiName="No" type="Struct47685" descr="Disable the paramter, ip-protocol, from use."/>
    <member name="yes" guiName="Yes" type="Struct47684" descr="Enable the parameter, ip-protocol, for use."/>
  </tUnion>
  <tUnion typeName="Union48099">
    <member name="no" guiName="No" type="Struct48098" descr="Disable the paramter, ip-tos, from use."/>
    <member name="yes" guiName="Yes" type="Struct48097" descr="Enable the parameter, ip-tos, for use."/>
  </tUnion>
  <tUnion typeName="Union48085">
    <member name="no" guiName="No" type="Struct48084" descr="Disable the paramter, ip-total-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48083" descr="Enable the parameter, ip-total-length, for use."/>
  </tUnion>
  <tUnion typeName="Union48096">
    <member name="no" guiName="No" type="Struct48095" descr="Disable the paramter, ip-ttl, from use."/>
    <member name="yes" guiName="Yes" type="Struct48094" descr="Enable the parameter, ip-ttl, for use."/>
  </tUnion>
  <tUnion typeName="Union48093">
    <member name="no" guiName="No" type="Struct48092" descr="Disable the paramter, ip-version, from use."/>
    <member name="yes" guiName="Yes" type="Struct48091" descr="Enable the parameter, ip-version, for use."/>
  </tUnion>
  <tUnion typeName="Union47996">
    <member name="no" guiName="No" type="Struct47991" descr="Disable the paramter, is-spoof-src, from use."/>
    <member name="yes" guiName="Yes" type="Struct47992" descr="Enable the parameter, is-spoof-src, for use."/>
  </tUnion>
  <tUnion typeName="Union48077">
    <member name="no" guiName="No" type="Struct48076" descr="Disable the paramter, l4-protocol, from use."/>
    <member name="yes" guiName="Yes" type="Struct48075" descr="Enable the parameter, l4-protocol, for use."/>
  </tUnion>
  <tUnion typeName="Union48030">
    <member name="no" guiName="No" type="Struct47816" descr="Disable the paramter, mac-flip, from use."/>
    <member name="yes" guiName="Yes" type="Struct48002" descr="Enable the parameter, mac-flip, for use."/>
  </tUnion>
  <tUnion typeName="Union48727" protected="true" >
    <member name="no" guiName="No" type="Struct48728" descr="Specify a MARS Category entry: No"/>
    <member name="yes" guiName="Yes" type="Struct48729" descr="Specify a MARS Category entry: Yes"/>
  </tUnion>
  <tUnion typeName="Union48241">
    <member name="no" guiName="No" type="Struct48240" descr="Disable the paramter, max-arg-field-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48120" descr="Enable the parameter, max-arg-field-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47575" protected="true" >
    <member name="no" guiName="No" type="Struct47573" descr="Disable the paramter, max-dgram-size, from use."/>
    <member name="yes" guiName="Yes" type="Struct47574" descr="Enable the parameter, max-dgram-size, for use."/>
  </tUnion>
  <tUnion typeName="Union47572" protected="true" >
    <member name="no" guiName="No" type="Struct47571" descr="Disable the paramter, max-fragments, from use."/>
    <member name="yes" guiName="Yes" type="Struct47570" descr="Enable the parameter, max-fragments, for use."/>
  </tUnion>
  <tUnion typeName="Union47587" protected="true" >
    <member name="no" guiName="No" type="Struct47586" descr="Disable the paramter, max-fragments-per-dgram, from use."/>
    <member name="yes" guiName="Yes" type="Struct47585" descr="Enable the parameter, max-fragments-per-dgram, for use."/>
  </tUnion>
  <tUnion typeName="Union48239">
    <member name="no" guiName="No" type="Struct48243" descr="Disable the paramter, max-header-field-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48121" descr="Enable the parameter, max-header-field-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47550" protected="true" >
    <member name="no" guiName="No" type="Struct47929" descr="Disable the paramter, max-last-fragments, from use."/>
    <member name="yes" guiName="Yes" type="Struct48409" descr="Enable the parameter, max-last-fragments, for use."/>
  </tUnion>
  <tUnion typeName="Union47415">
    <member name="no" guiName="No" type="Struct47411" descr="Disable the paramter, max-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct47412" descr="Enable the parameter, max-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union47498">
    <member name="no" guiName="No" type="Struct47497" descr="Disable the paramter, max-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct47496" descr="Enable the parameter, max-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union48166">
    <member name="no" guiName="No" type="Struct48169" descr="Disable the paramter, max-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct48167" descr="Enable the parameter, max-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union48384">
    <member name="no" guiName="No" type="Struct48382" descr="Disable the paramter, max-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct47635" descr="Enable the parameter, max-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union48480">
    <member name="no" guiName="No" type="Struct47549" descr="Disable the paramter, max-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct48277" descr="Enable the parameter, max-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union49104">
    <member name="no" guiName="No" type="Struct49107" descr="Disable the paramter, max-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct49105" descr="Enable the parameter, max-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union49149">
    <member name="no" guiName="No" type="Struct49152" descr="Disable the paramter, max-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct49150" descr="Enable the parameter, max-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union49188">
    <member name="no" guiName="No" type="Struct49191" descr="Disable the paramter, max-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct49189" descr="Enable the parameter, max-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union47578" protected="true" >
    <member name="no" guiName="No" type="Struct47576" descr="Disable the paramter, max-partial-dgrams, from use."/>
    <member name="yes" guiName="Yes" type="Struct47577" descr="Enable the parameter, max-partial-dgrams, for use."/>
  </tUnion>
  <tUnion typeName="Union48246">
    <member name="no" guiName="No" type="Struct48245" descr="Disable the paramter, max-request-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48119" descr="Enable the parameter, max-request-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47584" protected="true" >
    <member name="no" guiName="No" type="Struct47583" descr="Disable the paramter, max-small-frags, from use."/>
    <member name="yes" guiName="Yes" type="Struct47581" descr="Enable the parameter, max-small-frags, for use."/>
  </tUnion>
  <tUnion typeName="Union48248">
    <member name="no" guiName="No" type="Struct48249" descr="Disable the paramter, max-uri-field-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48118" descr="Enable the parameter, max-uri-field-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47582" protected="true" >
    <member name="no" guiName="No" type="Struct47580" descr="Disable the paramter, min-fragment-size, from use."/>
    <member name="yes" guiName="Yes" type="Struct47579" descr="Enable the parameter, min-fragment-size, for use."/>
  </tUnion>
  <tUnion typeName="Union47406">
    <member name="no" guiName="No" type="Struct47403" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct47405" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47509">
    <member name="no" guiName="No" type="Struct47506" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct47507" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47903">
    <member name="no" guiName="No" type="Struct47902" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct47901" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union48170">
    <member name="no" guiName="No" type="Struct48171" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48109" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union48310">
    <member name="no" guiName="No" type="Struct48311" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48116" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union48332">
    <member name="no" guiName="No" type="Struct48333" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48114" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union48344">
    <member name="no" guiName="No" type="Struct48345" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48112" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union48354">
    <member name="no" guiName="No" type="Struct48353" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48111" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union48508">
    <member name="no" guiName="No" type="Struct48509" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48506" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union49112">
    <member name="no" guiName="No" type="Struct49115" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct49113" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union49153">
    <member name="no" guiName="No" type="Struct49156" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct49154" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union49192">
    <member name="no" guiName="No" type="Struct49195" descr="Disable the paramter, min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct49193" descr="Enable the parameter, min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47410">
    <member name="no" guiName="No" type="Struct47407" descr="Disable the paramter, min-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct47409" descr="Enable the parameter, min-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union47502">
    <member name="no" guiName="No" type="Struct47501" descr="Disable the paramter, min-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct47499" descr="Enable the parameter, min-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union48168">
    <member name="no" guiName="No" type="Struct47844" descr="Disable the paramter, min-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct47842" descr="Enable the parameter, min-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union48278">
    <member name="no" guiName="No" type="Struct48471" descr="Disable the paramter, min-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct48472" descr="Enable the parameter, min-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union48342">
    <member name="no" guiName="No" type="Struct48343" descr="Disable the paramter, min-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct48110" descr="Enable the parameter, min-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union49100">
    <member name="no" guiName="No" type="Struct49103" descr="Disable the paramter, min-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct49101" descr="Enable the parameter, min-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union49145">
    <member name="no" guiName="No" type="Struct49148" descr="Disable the paramter, min-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct49146" descr="Enable the parameter, min-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union49184">
    <member name="no" guiName="No" type="Struct49187" descr="Disable the paramter, min-match-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct49185" descr="Enable the parameter, min-match-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union48387">
    <member name="no" guiName="No" type="Struct48386" descr="Disable the paramter, min-request-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct47860" descr="Enable the parameter, min-request-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47866">
    <member name="no" guiName="No" type="Struct48438" descr="Disable the paramter, object-id, from use."/>
    <member name="yes" guiName="Yes" type="Struct48439" descr="Enable the parameter, object-id, for use."/>
  </tUnion>
  <tUnion typeName="Union47447">
    <member name="no" guiName="No" type="Struct47444" descr="Disable the paramter, operation, from use."/>
    <member name="yes" guiName="Yes" type="Struct47446" descr="Enable the parameter, operation, for use."/>
  </tUnion>
  <tUnion typeName="Union48464">
    <member name="no" guiName="No" type="Struct48484" descr="Disable the paramter, operation, from use."/>
    <member name="yes" guiName="Yes" type="Struct48485" descr="Enable the parameter, operation, for use."/>
  </tUnion>
  <tUnion typeName="Union48586">
    <member name="no" guiName="No" type="Struct48587" descr="Disable the paramter, operation, from use."/>
    <member name="yes" guiName="Yes" type="Struct48588" descr="Enable the parameter, operation, for use."/>
  </tUnion>
  <tUnion typeName="Union47700">
    <member name="no" guiName="No" type="Struct47698" descr="Disable the paramter, packet-depth, from use."/>
    <member name="yes" guiName="Yes" type="Struct47697" descr="Enable the parameter, packet-depth, for use."/>
  </tUnion>
  <tUnion typeName="Union48053">
    <member name="no" guiName="No" type="Struct48051" descr="Disable the paramter, payload-inspection, from use."/>
    <member name="yes" guiName="Yes" type="Struct48052" descr="Enable the parameter, payload-inspection, for use."/>
  </tUnion>
  <tUnion typeName="Union47424">
    <member name="no" guiName="No" type="Struct47420" descr="Disable the paramter, payload-source, from use."/>
    <member name="yes" guiName="Yes" type="Struct47423" descr="Enable the parameter, payload-source, for use."/>
  </tUnion>
  <tUnion typeName="Union47491">
    <member name="no" guiName="No" type="Struct47490" descr="Disable the paramter, payload-source, from use."/>
    <member name="yes" guiName="Yes" type="Struct47489" descr="Enable the parameter, payload-source, for use."/>
  </tUnion>
  <tUnion typeName="Union47683">
    <member name="no" guiName="No" type="Struct47681" descr="Disable the paramter, payload-source, from use."/>
    <member name="yes" guiName="Yes" type="Struct47682" descr="Enable the parameter, payload-source, for use."/>
  </tUnion>
  <tUnion typeName="Union48280">
    <member name="no" guiName="No" type="Struct48281" descr="Disable the paramter, port-map-program, from use."/>
    <member name="yes" guiName="Yes" type="Struct47753" descr="Enable the parameter, port-map-program, for use."/>
  </tUnion>
  <tUnion typeName="Union47925">
    <member name="no" guiName="No" type="Struct47923" descr="Disable the paramter, port-range, from use."/>
    <member name="yes" guiName="Yes" type="Struct47924" descr="Enable the parameter, port-range, for use."/>
  </tUnion>
  <tUnion typeName="Union47930">
    <member name="no" guiName="No" type="Struct47928" descr="Disable the paramter, port-range, from use."/>
    <member name="yes" guiName="Yes" type="Struct47926" descr="Enable the parameter, port-range, for use."/>
  </tUnion>
  <tUnion typeName="Union47931">
    <member name="no" guiName="No" type="Struct47946" descr="Disable the paramter, port-range, from use."/>
    <member name="yes" guiName="Yes" type="Struct47945" descr="Enable the parameter, port-range, for use."/>
  </tUnion>
  <tUnion typeName="Union47655">
    <member name="no" guiName="No" type="Struct47653" descr="Disable the paramter, query-chaos-string, from use."/>
    <member name="yes" guiName="Yes" type="Struct47652" descr="Enable the parameter, query-chaos-string, for use."/>
  </tUnion>
  <tUnion typeName="Union47657">
    <member name="no" guiName="No" type="Struct47656" descr="Disable the paramter, query-class, from use."/>
    <member name="yes" guiName="Yes" type="Struct47654" descr="Enable the parameter, query-class, for use."/>
  </tUnion>
  <tUnion typeName="Union47660">
    <member name="no" guiName="No" type="Struct47659" descr="Disable the paramter, query-invalid-domain-name, from use."/>
    <member name="yes" guiName="Yes" type="Struct47658" descr="Enable the parameter, query-invalid-domain-name, for use."/>
  </tUnion>
  <tUnion typeName="Union47663">
    <member name="no" guiName="No" type="Struct47662" descr="Disable the paramter, query-jump-count-exceeded, from use."/>
    <member name="yes" guiName="Yes" type="Struct47661" descr="Enable the parameter, query-jump-count-exceeded, for use."/>
  </tUnion>
  <tUnion typeName="Union48035">
    <member name="no" guiName="No" type="Struct47665" descr="Disable the paramter, query-opcode, from use."/>
    <member name="yes" guiName="Yes" type="Struct47664" descr="Enable the parameter, query-opcode, for use."/>
  </tUnion>
  <tUnion typeName="Union47973">
    <member name="no" guiName="No" type="Struct47972" descr="Disable the paramter, query-record-data-invalid, from use."/>
    <member name="yes" guiName="Yes" type="Struct48036" descr="Enable the parameter, query-record-data-invalid, for use."/>
  </tUnion>
  <tUnion typeName="Union47976">
    <member name="no" guiName="No" type="Struct47975" descr="Disable the paramter, query-record-data-len, from use."/>
    <member name="yes" guiName="Yes" type="Struct47971" descr="Enable the parameter, query-record-data-len, for use."/>
  </tUnion>
  <tUnion typeName="Union47970">
    <member name="no" guiName="No" type="Struct47978" descr="Disable the paramter, query-src-port-53, from use."/>
    <member name="yes" guiName="Yes" type="Struct47977" descr="Enable the parameter, query-src-port-53, for use."/>
  </tUnion>
  <tUnion typeName="Union47810">
    <member name="no" guiName="No" type="Struct47967" descr="Disable the paramter, query-stream-len, from use."/>
    <member name="yes" guiName="Yes" type="Struct47969" descr="Enable the parameter, query-stream-len, for use."/>
  </tUnion>
  <tUnion typeName="Union48196">
    <member name="no" guiName="No" type="Struct47812" descr="Disable the paramter, query-type, from use."/>
    <member name="yes" guiName="Yes" type="Struct47811" descr="Enable the parameter, query-type, for use."/>
  </tUnion>
  <tUnion typeName="Union47850">
    <member name="no" guiName="No" type="Struct47801" descr="Disable the paramter, query-value, from use."/>
    <member name="yes" guiName="Yes" type="Struct47942" descr="Enable the parameter, query-value, for use."/>
  </tUnion>
  <tUnion typeName="Union48137">
    <member name="no" guiName="No" type="Struct48135" descr="Disable the paramter, regex-end-offset, from use."/>
    <member name="yes" guiName="Yes" type="Struct48134" descr="Enable the parameter, regex-end-offset, for use."/>
  </tUnion>
  <tUnion typeName="Union48139">
    <member name="no" guiName="No" type="Struct48138" descr="Disable the paramter, regex-min-match-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48136" descr="Enable the parameter, regex-min-match-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47428">
    <member name="no" guiName="No" type="Struct47426" descr="Disable the paramter, regex-string, from use."/>
    <member name="yes" guiName="Yes" type="Struct47427" descr="Enable the parameter, regex-string, for use."/>
  </tUnion>
  <tUnion typeName="Union47511">
    <member name="no" guiName="No" type="Struct47484" descr="Disable the paramter, regex-string, from use."/>
    <member name="yes" guiName="Yes" type="Struct47508" descr="Enable the parameter, regex-string, for use."/>
  </tUnion>
  <tUnion typeName="Union47546">
    <member name="no" guiName="No" type="Struct47545" descr="Disable the paramter, regex-string, from use."/>
    <member name="yes" guiName="Yes" type="Struct47552" descr="Enable the parameter, regex-string, for use."/>
  </tUnion>
  <tUnion typeName="Union47907">
    <member name="no" guiName="No" type="Struct47906" descr="Disable the paramter, regex-string, from use."/>
    <member name="yes" guiName="Yes" type="Struct47905" descr="Enable the parameter, regex-string, for use."/>
  </tUnion>
  <tUnion typeName="Union48651">
    <member name="no" guiName="No" type="Struct48652" descr=" "/>
    <member name="yes" guiName="Yes" type="Struct48653" descr=" "/>
  </tUnion>
  <tUnion typeName="Union49073">
    <member name="no" guiName="No" type="Struct49076" descr=" "/>
    <member name="yes" guiName="Yes" type="Struct49074" descr=" "/>
  </tUnion>
  <tUnion typeName="Union48011">
    <member name="no" guiName="No" type="Struct48010" descr="Disable the paramter, request-inbalance, from use."/>
    <member name="yes" guiName="Yes" type="Struct47820" descr="Enable the parameter, request-inbalance, for use."/>
  </tUnion>
  <tUnion typeName="Union48226">
    <member name="no" guiName="No" type="Struct48227" descr="Disable the paramter, request-regex, from use."/>
    <member name="yes" guiName="Yes" type="Struct48229" descr="Enable the parameter, request-regex, for use."/>
  </tUnion>
  <tUnion typeName="Union48583">
    <member name="no" guiName="No" type="Struct48584" descr="Disable the paramter, resource, from use."/>
    <member name="yes" guiName="Yes" type="Struct48585" descr="Enable the parameter, resource, for use."/>
  </tUnion>
  <tUnion typeName="Union47990">
    <member name="no" guiName="No" type="Struct47938" descr="Disable the paramter, rpc-max-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct47974" descr="Enable the parameter, rpc-max-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47799">
    <member name="no" guiName="No" type="Struct47798" descr="Disable the paramter, rpc-procedure, from use."/>
    <member name="yes" guiName="Yes" type="Struct47826" descr="Enable the parameter, rpc-procedure, for use."/>
  </tUnion>
  <tUnion typeName="Union48019">
    <member name="no" guiName="No" type="Struct47814" descr="Disable the paramter, rpc-program, from use."/>
    <member name="yes" guiName="Yes" type="Struct47813" descr="Enable the parameter, rpc-program, for use."/>
  </tUnion>
  <tUnion typeName="Union47438">
    <member name="no" guiName="No" type="Struct47434" descr="Disable the paramter, scan-interval, from use."/>
    <member name="yes" guiName="Yes" type="Struct47437" descr="Enable the parameter, scan-interval, for use."/>
  </tUnion>
  <tUnion typeName="Union48570">
    <member name="no" guiName="No" type="Struct48571" descr="Disable the paramter, scan-interval, from use."/>
    <member name="yes" guiName="Yes" type="Struct48572" descr="Enable the parameter, scan-interval, for use."/>
  </tUnion>
  <tUnion typeName="Union47632" protected="true" >
    <member name="no" guiName="No" type="Struct47638" descr="Disable the paramter, service-ports, from use."/>
    <member name="yes" guiName="Yes" type="Struct47637" descr="Enable the parameter, service-ports, for use."/>
  </tUnion>
  <tUnion typeName="Union49159">
    <member name="no" guiName="No" type="Struct49160" descr=" "/>
    <member name="yes" guiName="Yes" type="Struct49161" descr=" "/>
  </tUnion>
  <tUnion typeName="Union49197">
    <member name="no" guiName="No" type="Struct49198" descr=" "/>
    <member name="yes" guiName="Yes" type="Struct49199" descr=" "/>
  </tUnion>
  <tUnion typeName="Union48580">
    <member name="no" guiName="No" type="Struct48581" descr="Disable the paramter, set-count, from use."/>
    <member name="yes" guiName="Yes" type="Struct48582" descr="Enable the parameter, set-count, for use."/>
  </tUnion>
  <tUnion typeName="Union48263">
    <member name="no" guiName="No" type="Struct48264" descr="Disable the paramter, sql-username, from use."/>
    <member name="yes" guiName="Yes" type="Struct48117" descr="Enable the parameter, sql-username, for use."/>
  </tUnion>
  <tUnion typeName="Union48666">
    <member name="no" guiName="No" type="Struct48667" descr=" "/>
    <member name="yes" guiName="Yes" type="Struct48668" descr=" "/>
  </tUnion>
  <tUnion typeName="Union47741">
    <member name="no" guiName="No" type="Struct47740" descr="Disable the paramter, src-ip-addr, from use."/>
    <member name="yes" guiName="Yes" type="Struct47739" descr="Enable the parameter, src-ip-addr, for use."/>
  </tUnion>
  <tUnion typeName="Union47680">
    <member name="no" guiName="No" type="Struct47679" descr="Disable the paramter, src-port, from use."/>
    <member name="yes" guiName="Yes" type="Struct47678" descr="Enable the parameter, src-port, for use."/>
  </tUnion>
  <tUnion typeName="Union47744">
    <member name="no" guiName="No" type="Struct47743" descr="Disable the paramter, src-port, from use."/>
    <member name="yes" guiName="Yes" type="Struct47742" descr="Enable the parameter, src-port, for use."/>
  </tUnion>
  <tUnion typeName="Union47751">
    <member name="no" guiName="No" type="Struct47749" descr="Disable the paramter, src-port, from use."/>
    <member name="yes" guiName="Yes" type="Struct47748" descr="Enable the parameter, src-port, for use."/>
  </tUnion>
  <tUnion typeName="Union48406">
    <member name="no" guiName="No" type="Struct47956" descr="Disable the paramter, summary-threshold, from use."/>
    <member name="yes" guiName="Yes" type="Struct47955" descr="Enable the parameter, summary-threshold, for use."/>
  </tUnion>
  <tUnion typeName="Union48632" protected="true" >
    <member name="no" guiName="No" type="Struct47631" descr="Disable the paramter, syn-flood-max-embrionic, from use."/>
    <member name="yes" guiName="Yes" type="Struct47815" descr="Enable the parameter, syn-flood-max-embrionic, for use."/>
  </tUnion>
  <tUnion typeName="Union47600" protected="true" >
    <member name="no" guiName="No" type="Struct47598" descr="Disable the paramter, tcp-closed-timeout, from use."/>
    <member name="yes" guiName="Yes" type="Struct47599" descr="Enable the parameter, tcp-closed-timeout, for use."/>
  </tUnion>
  <tUnion typeName="Union47597" protected="true" >
    <member name="no" guiName="No" type="Struct47596" descr="Disable the paramter, tcp-embryonic-timeout, from use."/>
    <member name="yes" guiName="Yes" type="Struct47595" descr="Enable the parameter, tcp-embryonic-timeout, for use."/>
  </tUnion>
  <tUnion typeName="Union47483">
    <member name="no" guiName="No" type="Struct47463" descr="Disable the paramter, flags, from use."/>
    <member name="yes" guiName="Yes" type="Struct47482" descr="Enable the parameter, flags, for use."/>
  </tUnion>
  <tUnion typeName="Union48047">
    <member name="no" guiName="No" type="Struct48046" descr="Disable the paramter, tcp-header-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48045" descr="Enable the parameter, tcp-header-length, for use."/>
  </tUnion>
  <tUnion typeName="Union47594">
    <member name="no" guiName="No" type="Struct47593" descr="Disable the paramter, tcp-idle-timeout, from use."/>
    <member name="yes" guiName="Yes" type="Struct47591" descr="Enable the parameter, tcp-idle-timeout, for use."/>
  </tUnion>
  <tUnion typeName="Union47612" protected="true" >
    <member name="no" guiName="No" type="Struct47611" descr="Disable the paramter, tcp-max-mss, from use."/>
    <member name="yes" guiName="Yes" type="Struct47610" descr="Enable the parameter, tcp-max-mss, for use."/>
  </tUnion>
  <tUnion typeName="Union47603" protected="true" >
    <member name="no" guiName="No" type="Struct47602" descr="Disable the paramter, tcp-max-queue, from use."/>
    <member name="yes" guiName="Yes" type="Struct47601" descr="Enable the parameter, tcp-max-queue, for use."/>
  </tUnion>
  <tUnion typeName="Union47609" protected="true" >
    <member name="no" guiName="No" type="Struct47608" descr="Disable the paramter, tcp-min-mss, from use."/>
    <member name="yes" guiName="Yes" type="Struct47607" descr="Enable the parameter, tcp-min-mss, for use."/>
  </tUnion>
  <tUnion typeName="Union47606" protected="true" >
    <member name="no" guiName="No" type="Struct47605" descr="Disable the paramter, tcp-option-number, from use."/>
    <member name="yes" guiName="Yes" type="Struct47604" descr="Enable the parameter, tcp-option-number, for use."/>
  </tUnion>
  <tUnion typeName="Union48156">
    <member name="no" guiName="No" type="Struct48050" descr="Disable the paramter, tcp-payload-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48048" descr="Enable the parameter, tcp-payload-length, for use."/>
  </tUnion>
  <tUnion typeName="Union48044">
    <member name="no" guiName="No" type="Struct48042" descr="Disable the paramter, tcp-reserved, from use."/>
    <member name="yes" guiName="Yes" type="Struct48043" descr="Enable the parameter, tcp-reserved, for use."/>
  </tUnion>
  <tUnion typeName="Union48056">
    <member name="no" guiName="No" type="Struct48055" descr="Disable the paramter, tcp-urg-pointer, from use."/>
    <member name="yes" guiName="Yes" type="Struct48054" descr="Enable the parameter, tcp-urg-pointer, for use."/>
  </tUnion>
  <tUnion typeName="Union48174">
    <member name="no" guiName="No" type="Struct48175" descr="Disable the paramter, tcp-window-size, from use."/>
    <member name="yes" guiName="Yes" type="Struct48057" descr="Enable the parameter, tcp-window-size, for use."/>
  </tUnion>
  <tUnion typeName="Union47443">
    <member name="no" guiName="No" type="Struct47442" descr="Disable the paramter, type, from use."/>
    <member name="yes" guiName="Yes" type="Struct47441" descr="Enable the parameter, type, for use."/>
  </tUnion>
  <tUnion typeName="Union48577">
    <member name="no" guiName="No" type="Struct48578" descr="Disable the paramter, type, from use."/>
    <member name="yes" guiName="Yes" type="Struct48579" descr="Enable the parameter, type, for use."/>
  </tUnion>
  <tUnion typeName="Union48012">
    <member name="no" guiName="No" type="Struct48024" descr="Disable the paramter, type-of-arp-sig, from use."/>
    <member name="yes" guiName="Yes" type="Struct47822" descr="Enable the parameter, type-of-arp-sig, for use."/>
  </tUnion>
  <tUnion typeName="Union48079">
    <member name="no" guiName="No" type="Struct48442" descr="Disable the paramter, udp-length-mismatch, from use."/>
    <member name="yes" guiName="Yes" type="Struct48441" descr="Enable the parameter, udp-length-mismatch, for use."/>
  </tUnion>
  <tUnion typeName="Union48179">
    <member name="no" guiName="No" type="Struct47754" descr="Disable the paramter, udp-valid-length, from use."/>
    <member name="yes" guiName="Yes" type="Struct48163" descr="Enable the parameter, udp-valid-length, for use."/>
  </tUnion>
  <tUnion typeName="Union48233">
    <member name="no" guiName="No" type="Struct48234" descr="Disable the paramter, uri-regex, from use."/>
    <member name="yes" guiName="Yes" type="Struct48122" descr="Enable the parameter, uri-regex, for use."/>
  </tUnion>
  <tUnion typeName="Union47461">
    <member name="no" guiName="No" type="Struct47457" descr="Disable the paramter, uuid, from use."/>
    <member name="yes" guiName="Yes" type="Struct47460" descr="Enable the parameter, uuid, for use."/>
  </tUnion>
  <tUnion typeName="Union48487">
    <member name="no" guiName="No" type="Struct48488" descr="Disable the paramter, uuid, from use."/>
    <member name="yes" guiName="Yes" type="Struct48489" descr="Enable the parameter, uuid, for use."/>
  </tUnion>
  <tUnion typeName="Union47910">
    <member name="no" guiName="No" type="Struct47909" descr="Disable the paramter, value-range, from use."/>
    <member name="yes" guiName="Yes" type="Struct47908" descr="Enable the parameter, value-range, for use."/>
  </tUnion>
  <tUnion typeName="Union48574">
    <member name="no" guiName="No" type="Struct48575" descr="Disable the paramter, word-count, from use."/>
    <member name="yes" guiName="Yes" type="Struct48576" descr="Enable the parameter, word-count, for use."/>
  </tUnion>
  <tUnion typeName="Union48638">
    <member name="v1" guiName="Version 1" type="Struct48640" descr="SSH version 1"/>
    <member name="v2" guiName="Version 2" type="Struct48639" descr="SSH Version 2"/>
  </tUnion>
  <tUnion typeName="Union47532">
    <member name="cisco-login" guiName="Cisco Login" type="Struct47530" descr="cisco-login state"/>
    <member name="lpr-format-string" guiName="LPR Format String" type="Struct47531" descr="State engine to inspect for the LPR format string vulnerability"/>
    <member name="smtp" guiName="SMTP" type="Struct47529" descr="State machine for the SMTP protocol"/>
  </tUnion>
  <tUnion typeName="Union47863">
    <member name="fire-all" guiName="Fire All" type="Struct48401" descr="Fire an alert on all events."/>
    <member name="fire-once" guiName="Fire Once" type="Struct47864" descr="Fire an alert only once."/>
    <member name="global-summarize" guiName="Global Summarize" type="Struct48402" descr="Summarize an alert so that it will only fire once regardless of how many attackers or victims."/>
    <member name="summarize" guiName="Summarize" type="Struct47865" descr="Summarize alerts"/>
  </tUnion>
  <tUnion typeName="Union47767">
    <member name="chunked-transfer-encoding-error" guiName="Chunked Transfer Encoding Error" type="Struct47869" descr="Inspection for chunked tranfer encoding errors"/>
    <member name="define-transfer-encoding" guiName="Define Transfer Encoding" type="String" descr="define-transfer-encoding"/>
    <member name="recognized-transfer-encodings" guiName="Recognized Transfer Encodings" type="List47766" descr="recognized-transfer-encoding"/>
  </tUnion>
  <tInteger typeName="Integer0-65535--0"  min="0"  max="65535" default="0" />
  <tInteger typeName="Integer1-16--10"  min="1"  max="16" default="10" />
  <tIntegerRange typeName="AICwebports"  min="0"  max="65535" default="80-80,3128-3128,8000-8000,8010-8010,8080-8080,8888-8888,24326-24326"  allowMultiple="true" />
  <tInteger typeName="Integer30-300--30"  min="30"  max="300" default="30" />
  <tInteger typeName="Integer0-2147483647--0"  min="0"  max="2147483647" default="0" />
  <tEnum typeName="FragMode" default="nt">
    <value name="nt" guiName="NT" descr="Windows Systems"/>
    <value name="solaris" guiName="Solaris" descr="Solaris Systems"/>
    <value name="linux" guiName="Linux" descr="GNU/Linux Systems"/>
    <value name="bsd" guiName="BSD" descr="BSD based systems"/>
  </tEnum>
  <tEnum typeName="ReassemblyMode" default="strict">
    <value name="strict" guiName="Strict" descr="TCP reassembly only allow next expected in sequence."/>
    <value name="loose" guiName="Loose" descr="TCP reassembly allow gaps in sequence."/>
    <value name="asym" guiName="Asymmetric" descr="TCP reassembly allows asymmetric traffic to be reassembled. Warning! This will disable TCP window evasion checking."/>
  </tEnum>
  <tStruct typeName="HttpApplicationStruct">
    <member name="http-enable" guiName="Enable HTTP" type="Bool" default="false" descr="Enable HTTP application policy enforcement"/>
    <member name="max-outstanding-http-requests-per-connection" guiName="Max HTTP Requests" type="Integer1-16--10" descr="Maximum allowed http requests per connection."/>
    <member name="aic-web-ports" guiName="AIC Web Ports" type="AICwebports" descr="variable for ports to look for AIC traffic"/>
  </tStruct>
  <tStruct typeName="ApplicationPolicy">
    <member name="http-policy" guiName="HTTP Policy" type="HttpApplicationStruct" descr="HTTP application policy enforcement settings"/>
    <member name="ftp-enable" guiName="Enable FTP" type="Bool" default="false" descr="Enable FTP application policy enforcement"/>
  </tStruct>
  <tStruct typeName="FragmentReassembly">
    <member name="ip-reassemble-mode" guiName="IP Reassembly Mode" type="FragMode" descr="Identifies the method the sensor will use to reassemble the fragments, based on the operating system."/>
  </tStruct>
  <tStruct typeName="StreamReassembly">
    <member name="tcp-3-way-handshake-required" guiName="TCP Handshake Required" type="Bool" default="true" descr="Specifies that the sensor should only track sessions for which the three-way handshake is completed."/>
    <member name="tcp-reassembly-mode" guiName="TCP Reassembly Mode" type="ReassemblyMode" descr="Specifies the mode the sensor should use to reassemble tcp sessions."/>
  </tStruct>
  <tStruct typeName="IpLog">
    <member name="ip-log-packets" guiName="Max IP Log Packets" type="Integer0-65535--0" descr="Identifies the number of packets you want logged."/>
    <member name="ip-log-time" guiName="IP Log Time" type="Integer30-300--30" descr="Identifies the duration, in seconds, you want the sensor to log."/>
    <member name="ip-log-bytes" guiName="Max IP Log Bytes" type="Integer0-2147483647--0" descr="Identifies the maximum number of bytes you want logged."/>
  </tStruct>
  <tUnion typeName="Variable">
    <member name="web-ports" guiName="Web Ports" type="IntegerRange0-65535am" descr="System defined variable for ports to look for http traffic."/>
    <member name="ip-addr-range" guiName="IP address range" type="IpV4AddrRangeam" descr="System defined variable for grouping IP addresses."/>
  </tUnion>
  <tString typeName="Name" pattern="^[-a-zA-Z0-9_]+$" />
  <tMap typeName="_variables_" descr="User defined variables" valType="Variable" valName="variable" min="0" max="256">
    <key name="variable-name" type="Name" descr="Name of the variable"/>
  </tMap>
  <tStruct typeName="_root_">
    <member name="variables" type="_variables_" descr=" "/>
    <member name="application-policy" type="ApplicationPolicy" guiName="Application Policy" descr="Application Policy Enforcement Parameters"/>
    <member name="fragment-reassembly" type="FragmentReassembly" guiName="Fragment Reassembly" descr="IP Fragment reassemly configuration"/>
    <member name="stream-reassembly" type="StreamReassembly" guiName="Stream Reassembly" descr="TCP stream assembly configuration"/>
    <member name="ip-log" type="IpLog" guiName="IP Log" descr="IP log configuration"/>
    <member name="signatures" type="Map48392" guiName="Signatures" descr="Signature definitions"/>
  </tStruct>
</typedefs> </component>
 </setTypedefs>
 <setSigCategories xmlns="http://www.cisco.com/cids/idconf">
  <component name="signatureDefinition"> 
   <config xmlns="http://www.cisco.com/cids/idconf">  <category name="OS" cli_name="os">
    <category name="UNIX" cli_name="unix">
      <category name="General UNIX"  cli_name="general_unix">
        <sigids>3105,3107,3114,3115,3118,3124,3125,3126,3161,3162,3163,3171,3200,3201,3208,3209,3224,3225,3232,3254,3255,3325,3352,3401,3402,3403,3404,3406,3408,3450,3452,3457,3461,3462,3463,3464,3500,3501,3502,3525,3526,3527,3550,3575,3576,3700,3706,3707,3734,3735,3884,4509,5035,5039,5041,5045,5069,5072,5157,5162,5196,5208,5218,5236,5255,5257,5272,5273,5305,5306,5307,5329,5330,5339,5358,5457,5460,5488,5509,5543,5666,5681,5714,5770,6055,6056,6057,6058,6059,6060,6061,6062,6064,6067,6100,6101,6102,6103,6104,6105,6110,6111,6112,6113,6114,6115,6116,6117,6118,6120,6121,6122,6123,6124,6125,6126,6127,6128,6151,6152,6153,6154,6155,6175,6180,6188,6189,6190,6191,6192,6193,6200,6201,6202,6210,6211,6276,6277,6300,6302,6303,6508,6546</sigids>
        <sig_subsig_ids>3105.0,3107.0,3114.0,3115.0,3115.3,3118.0,3124.0,3125.0,3126.0,3161.0,3161.1,3162.0,3163.0,3171.0,3200.0,3201.1,3201.2,3201.3,3201.4,3201.5,3201.6,3208.0,3209.0,3224.0,3225.0,3232.0,3254.1,3255.0,3325.0,3352.0,3401.0,3401.1,3402.0,3402.1,3402.2,3402.3,3402.4,3403.0,3404.0,3404.1,3406.0,3408.0,3450.0,3452.0,3457.0,3461.0,3462.0,3463.0,3464.0,3500.0,3501.0,3502.0,3525.0,3526.0,3527.0,3527.3,3527.6,3550.0,3575.0,3576.0,3700.0,3706.0,3707.0,3734.0,3735.0,3884.0,4509.0,5035.0,5039.0,5041.0,5045.0,5069.0,5072.0,5157.0,5162.0,5196.0,5196.1,5208.0,5218.0,5236.0,5255.0,5257.0,5272.0,5273.0,5273.1,5273.2,5273.3,5305.0,5305.1,5305.2,5305.3,5306.0,5307.0,5329.0,5330.0,5339.0,5358.0,5457.0,5460.0,5488.0,5509.0,5543.0,5666.0,5681.0,5714.0,5770.0,6055.0,6055.1,6055.2,6056.0,6056.1,6056.2,6057.0,6057.1,6057.2,6058.0,6058.1,6059.0,6059.1,6059.2,6060.0,6060.1,6060.2,6060.3,6061.0,6061.1,6062.0,6062.1,6064.0,6067.0,6100.0,6100.1,6101.0,6101.1,6102.0,6102.1,6103.0,6103.1,6104.0,6104.1,6105.0,6105.1,6110.0,6110.1,6111.0,6111.1,6112.0,6112.1,6113.0,6113.1,6114.0,6114.1,6115.0,6115.1,6116.0,6116.1,6117.0,6117.1,6118.0,6118.1,6120.0,6120.1,6121.0,6121.1,6122.0,6122.1,6123.0,6123.1,6124.0,6124.1,6125.0,6125.1,6126.0,6126.1,6127.0,6127.1,6128.0,6128.1,6151.0,6151.1,6152.0,6152.1,6153.0,6153.1,6154.0,6154.1,6155.0,6155.1,6175.0,6175.1,6180.0,6180.1,6188.0,6189.0,6189.1,6190.0,6190.1,6191.0,6191.1,6192.0,6192.1,6193.0,6193.1,6200.0,6201.0,6202.1,6202.2,6210.0,6211.0,6276.0,6276.1,6277.0,6277.1,6300.0,6302.0,6303.0,6508.0,6508.1,6508.2,6546.0</sig_subsig_ids>
      </category>
      <category name="Linux" cli_name="linux">
        <category name="General Linux"  cli_name="general_linux">
          <sigids>3175,3736,3737,4617,5062,5078,5107,5110,5132,5332,5433,5454,5549,5562,5594,5634,5643,5660,5703,5708,6068,6195,6259,6532,6765,9506</sigids>
          <sig_subsig_ids>3175.0,3736.0,3737.0,4617.0,4617.1,5062.0,5078.0,5107.0,5110.0,5132.0,5332.0,5433.0,5454.0,5549.0,5562.0,5594.0,5634.0,5643.0,5660.0,5703.0,5708.0,6068.0,6195.0,6195.1,6259.0,6532.0,6765.0,9506.0</sig_subsig_ids>
        </category>
        <category  name="RedHat"  cli_name="redhat">
          <sigids>5265</sigids>
          <sig_subsig_ids>5265.0</sig_subsig_ids>
        </category>
        <category  name="Gentoo"  cli_name="gentoo">
          <sigids>5410</sigids>
          <sig_subsig_ids>5410.0</sig_subsig_ids>
        </category>
        <category  name="Mandrake"  cli_name="mandrake">
          <sigids></sigids>
          <sig_subsig_ids></sig_subsig_ids>
        </category>
        <category  name="SuSE"  cli_name="suse">
          <sigids></sigids>
          <sig_subsig_ids></sig_subsig_ids>
        </category>
      </category>
      <category  name="Solaris"  cli_name="solaris">
        <sigids>3400,3455,3456,3710,3788,3791,4510,5087,5108,5111,5112,5348,5517,5655,5842,6150,6194,6196,6197,6198,6199,6203,9473,9519,9538,9560</sigids>
        <sig_subsig_ids>3400.0,3455.0,3456.0,3456.1,3456.3,3710.0,3788.0,3791.0,4510.0,5087.0,5087.1,5108.0,5108.1,5108.2,5111.0,5112.0,5348.0,5517.0,5655.0,5842.0,6150.0,6150.1,6194.0,6194.1,6196.0,6196.1,6197.0,6197.1,6198.0,6198.1,6199.0,6199.1,6203.0,6203.1,9473.1,9519.1,9538.0,9560.2</sig_subsig_ids>
      </category>
      <category  name="HP-UX"  cli_name="hp-ux">
        <sigids>5158,5668,5675</sigids>
        <sig_subsig_ids>5158.0,5668.0,5675.0</sig_subsig_ids>
      </category>
      <category  name="AIX"  cli_name="aix">
        <sigids>3155,3156</sigids>
        <sig_subsig_ids>3155.0,3156.0</sig_subsig_ids>
      </category>
      <category  name="IRIX"  cli_name="irix">
        <sigids>3218,3223,3226,3228,3787,4054,5037,5065,5300,5303,5309,5505,6275</sigids>
        <sig_subsig_ids>3218.0,3223.0,3226.0,3228.0,3787.0,4054.0,4054.1,5037.0,5065.0,5300.0,5303.0,5309.0,5505.0,5505.1,6275.0,6275.1</sig_subsig_ids>
      </category>
    </category>
    <category name="Windows" cli_name="windows">
      <category name="General Windows"  cli_name="general_windows">
        <sigids>2156,2158,2200,2201,3108,3111,3132,3133,3134,3135,3136,3137,3138,3139,3140,3141,3142,3143,3144,3145,3146,3160,3164,3170,3171,3172,3177,3178,3181,3202,3203,3204,3205,3206,3207,3210,3211,3230,3234,3252,3300,3301,3302,3303,3304,3305,3306,3307,3309,3310,3312,3313,3315,3316,3317,3318,3319,3320,3322,3323,3324,3326,3327,3328,3331,3334,3336,3337,3339,3340,3341,3342,3343,3345,3348,3349,3350,3351,3353,3405,3451,3458,3708,3709,3716,3719,3720,3740,3793,3990,3991,3992,4053,4055,4058,4060,4068,4101,4151,4503,4516,4602,4607,4615,5052,5053,5057,5059,5061,5063,5064,5084,5086,5090,5091,5097,5109,5146,5148,5168,5169,5172,5177,5204,5205,5216,5223,5239,5278,5292,5294,5311,5314,5316,5323,5326,5338,5346,5351,5359,5360,5362,5363,5369,5374,5389,5390,5392,5393,5395,5400,5401,5402,5406,5412,5413,5414,5416,5417,5424,5425,5426,5434,5435,5436,5439,5442,5443,5446,5447,5448,5449,5450,5451,5452,5456,5461,5463,5469,5472,5478,5482,5483,5484,5487,5488,5489,5492,5493,5494,5495,5496,5497,5498,5499,5500,5501,5502,5503,5506,5510,5515,5519,5520,5523,5524,5525,5531,5532,5533,5534,5544,5546,5547,5548,5551,5552,5554,5556,5557,5560,5561,5564,5565,5566,5567,5568,5569,5570,5571,5572,5573,5575,5576,5577,5578,5579,5582,5584,5587,5588,5589,5590,5591,5592,5593,5595,5596,5600,5601,5602,5605,5608,5609,5611,5633,5635,5637,5639,5641,5642,5644,5646,5647,5649,5659,5661,5683,5687,5688,5689,5694,5695,5696,5698,5699,5706,5711,5713,5715,5717,5723,5726,5730,5731,5732,5734,5735,5736,5737,5738,5740,5747,5753,5757,5759,5764,5767,5771,5774,5776,5777,5778,5792,5795,5800,5806,5809,5813,5814,5817,5821,5823,5826,5827,5829,5839,5840,5843,5845,5848,5849,5852,5856,5862,5865,5870,5871,5873,5874,5876,5877,5878,5885,5887,5888,5889,5892,5894,5898,5899,5902,5903,5905,5906,5908,5915,5916,5918,5919,5928,6007,6011,6012,6013,6017,6030,6069,6130,6131,6171,6224,6229,6232,6246,6249,6257,6258,6262,6263,6264,6265,6266,6271,6272,6273,6274,6278,6298,6299,6403,6406,6408,6409,6410,6500,6509,6510,6512,6513,6524,6527,6533,6534,6535,6536,6537,6539,6540,6541,6544,6545,6755,6760,6767,6775,6776,6777,6778,6780,6784,6785,6786,6787,6788,6790,6792,6793,6794,6798,6921,6922,6923,6924,6925,6928,6929,6930,6934,6935,6936,6937,6939,6940,6942,6945,6946,6951,6952,6960,6961,6963,6966,6967,6968,6969,7203,9024,9025,9026,9027,9028,9029,9030,9033,9036,9037,9038,9039,9040,9041,9042,9043,9044,9045,9200,9203,9204,9226,9227,9228,9229,9230,9231,9233,9236,9237,9238,9239,9240,9241,9242,9243,9244,9245,9400,9401,9402,9403,9404,9405,9406,9407,9408,9409,9410,9411,9412,9413,9414,9415,9416,9417,9418,9419,9420,9421,9422,9423,9424,9425,9426,9427,9428,9429,9430,9431,9432,9433,9434,9435,9436,9437,9438,9439,9440,9441,9442,9443,9444,9445,9446,9447,9449,9450,9451,9452,9453,9454,9455,9456,9457,9458,9459,9460,9461,9462,9463,9464,9465,9466,9467,9468,9469,9470,9471,9472,9473,9474,9475,9476,9477,9478,9479,9480,9481,9482,9483,9484,9485,9486,9487,9488,9489,9490,9491,9492,9493,9494,9495,9496,9497,9498,9499,9500,9501,9502,9503,9504,9505,9507,9508,9509,9510,9511,9512,9513,9514,9515,9516,9517,9518,9519,9520,9521,9522,9523,9524,9525,9527,9528,9529,9530,9531,9532,9533,9534,9535,9536,9537,9539,9540,9541,9542,9543,9544,9545,9546,9547,9548,9549,9550,9551,9552,9553,9554,9555,9556,9557,9558,9559,9560,9561,9562,9563,9564,9565,9566,9567,9568,9570,9571,9572,9573,9574,9575,9576,9577,9578,9579,9580,9581,9582,9583,11004,11011,11028,11029,12000,12001,12002,12003,12004,12005,12006,12007,12008,12009,12010,12011,12012,12013,12014,12015,12016,12017,12018,12019,12020,12021,12022,12023,12024,12025,12026,12027</sigids>
        <sig_subsig_ids>2156.0,2158.0,2200.0,2201.0,3108.0,3111.0,3111.1,3132.0,3132.1,3133.0,3133.1,3134.0,3135.0,3135.1,3135.2,3135.3,3135.4,3135.5,3135.6,3135.7,3136.0,3136.1,3136.2,3136.3,3136.4,3136.5,3136.6,3136.7,3136.8,3136.9,3136.10,3136.11,3137.0,3137.1,3137.2,3137.3,3137.4,3137.5,3137.6,3138.0,3139.0,3140.0,3140.1,3140.2,3140.3,3140.4,3140.5,3140.6,3140.7,3140.8,3140.9,3140.10,3140.11,3140.12,3140.13,3140.14,3140.15,3140.16,3140.17,3140.18,3140.19,3141.0,3142.0,3142.1,3142.3,3143.0,3143.1,3143.2,3143.3,3143.4,3144.0,3145.0,3145.1,3146.0,3160.0,3164.0,3170.0,3171.1,3172.0,3177.0,3178.0,3181.0,3202.0,3203.0,3204.0,3205.0,3206.0,3207.0,3210.0,3210.1,3210.2,3210.3,3211.0,3230.0,3234.0,3234.1,3252.0,3300.0,3301.0,3302.0,3303.0,3304.0,3305.0,3306.0,3307.0,3309.0,3310.0,3312.0,3313.0,3315.0,3316.0,3317.0,3318.0,3319.0,3320.0,3322.0,3323.0,3324.0,3326.0,3327.0,3327.1,3327.2,3327.3,3327.4,3327.5,3327.6,3327.7,3327.8,3327.9,3327.10,3327.11,3327.12,3327.13,3328.0,3328.1,3328.2,3328.3,3331.1,3334.0,3334.1,3334.2,3334.7,3336.0,3337.0,3339.0,3340.0,3341.0,3342.0,3342.1,3343.0,3345.0,3348.0,3349.0,3350.0,3351.0,3353.0,3405.0,3451.0,3458.0,3708.0,3709.0,3716.0,3716.1,3719.0,3720.0,3740.0,3793.0,3990.1,3990.2,3991.0,3992.1,3992.2,3992.3,3992.4,3992.5,4053.0,4055.1,4055.2,4058.0,4058.1,4058.2,4060.0,4060.1,4068.0,4101.0,4151.0,4151.1,4503.0,4503.1,4516.0,4602.0,4602.1,4602.2,4602.3,4602.4,4607.0,4607.1,4607.2,4607.3,4607.4,4607.5,4607.6,4607.7,4607.8,4607.9,4615.0,4615.1,4615.2,4615.3,5052.0,5053.0,5057.0,5057.1,5059.0,5059.1,5059.2,5061.0,5063.0,5064.0,5084.0,5084.1,5086.0,5090.0,5091.0,5091.1,5097.0,5097.1,5097.2,5109.0,5109.1,5146.0,5146.1,5146.2,5146.3,5146.4,5146.5,5146.6,5146.7,5146.8,5146.9,5146.10,5146.11,5146.12,5146.13,5146.14,5146.15,5146.16,5146.17,5148.0,5168.0,5169.0,5172.0,5177.0,5177.1,5204.0,5204.1,5205.0,5216.0,5216.1,5223.0,5239.0,5278.0,5292.0,5294.0,5311.0,5314.0,5316.0,5323.0,5326.0,5338.0,5346.0,5351.0,5359.0,5360.0,5362.0,5363.0,5369.0,5374.2,5389.0,5390.0,5392.0,5393.0,5395.0,5400.0,5401.0,5402.0,5406.0,5406.1,5412.0,5413.0,5414.0,5416.0,5416.1,5417.0,5424.0,5425.0,5426.0,5434.0,5434.1,5435.0,5436.0,5436.1,5439.0,5442.0,5443.0,5446.0,5447.0,5448.0,5449.0,5450.0,5451.0,5452.0,5456.0,5461.0,5463.0,5463.1,5469.0,5469.1,5472.0,5478.0,5478.1,5482.0,5483.0,5484.0,5487.0,5488.0,5489.0,5489.1,5489.2,5489.3,5489.4,5489.5,5489.6,5489.7,5492.0,5493.0,5494.0,5495.0,5496.0,5497.0,5498.0,5499.0,5500.0,5501.0,5502.0,5502.1,5502.2,5502.3,5502.4,5503.0,5506.0,5506.1,5510.0,5515.0,5519.0,5520.0,5523.0,5524.0,5525.0,5531.0,5532.0,5533.0,5534.0,5534.1,5534.2,5544.0,5546.0,5547.0,5548.0,5551.0,5552.0,5554.0,5556.0,5556.1,5556.2,5556.3,5556.4,5557.0,5557.1,5557.2,5560.0,5561.0,5561.1,5561.2,5564.0,5565.0,5565.1,5565.2,5565.3,5565.4,5566.0,5567.0,5567.1,5567.2,5567.3,5567.4,5567.5,5567.6,5567.7,5567.8,5568.0,5569.0,5570.0,5571.0,5572.0,5572.1,5572.2,5573.0,5575.0,5576.0,5577.0,5578.0,5579.0,5579.1,5582.0,5584.0,5587.0,5588.0,5588.1,5589.0,5590.1,5591.1,5592.0,5593.0,5595.0,5596.0,5600.0,5601.1,5602.0,5605.0,5608.0,5609.0,5609.1,5609.2,5611.0,5633.0,5635.0,5635.1,5635.2,5637.0,5639.0,5641.0,5641.1,5641.2,5642.0,5642.1,5642.2,5642.3,5644.0,5644.1,5644.2,5644.3,5646.0,5647.0,5649.0,5659.0,5661.0,5683.0,5683.1,5683.2,5687.0,5688.0,5689.0,5694.0,5695.0,5696.0,5696.1,5698.0,5699.0,5706.0,5711.0,5713.0,5715.0,5717.0,5723.0,5726.0,5726.1,5730.0,5731.1,5731.2,5732.1,5732.2,5734.0,5735.0,5736.0,5737.0,5738.1,5740.0,5740.1,5747.0,5747.1,5747.2,5753.0,5757.0,5759.0,5764.0,5767.0,5771.0,5774.0,5776.3,5776.4,5777.0,5778.0,5792.0,5795.0,5800.0,5806.0,5806.1,5806.2,5806.3,5806.4,5809.0,5809.1,5809.2,5809.3,5813.0,5813.1,5813.2,5813.3,5813.4,5814.1,5814.2,5817.0,5821.0,5821.1,5821.2,5823.0,5826.0,5827.0,5827.1,5827.2,5829.0,5839.0,5840.0,5840.1,5840.2,5843.0,5845.0,5848.0,5849.0,5852.0,5856.0,5856.1,5856.2,5862.0,5865.0,5865.1,5865.2,5870.0,5871.0,5873.0,5874.0,5876.0,5877.0,5878.0,5885.0,5887.0,5888.0,5889.0,5892.0,5894.0,5894.1,5898.0,5899.0,5902.0,5903.0,5903.2,5905.0,5905.1,5906.0,5908.0,5908.1,5908.2,5915.0,5916.0,5918.0,5918.1,5919.0,5928.0,6007.0,6011.0,6012.0,6013.0,6013.1,6017.0,6017.1,6017.2,6017.3,6017.4,6017.5,6030.0,6069.0,6069.1,6069.2,6069.3,6069.4,6069.5,6069.6,6069.7,6069.8,6130.1,6130.2,6130.4,6130.6,6130.7,6130.8,6130.10,6131.0,6131.1,6131.3,6131.4,6131.6,6131.10,6131.11,6171.0,6224.0,6229.0,6229.1,6229.2,6232.0,6246.0,6246.1,6249.0,6257.0,6258.0,6262.0,6263.0,6264.0,6265.0,6266.0,6271.0,6272.0,6273.0,6274.0,6278.0,6278.1,6278.2,6298.0,6298.1,6299.0,6403.0,6403.1,6406.0,6408.0,6408.1,6409.0,6409.1,6409.2,6410.0,6410.1,6410.2,6500.0,6500.1,6509.0,6509.1,6509.2,6510.0,6510.1,6510.2,6512.0,6512.1,6512.2,6513.0,6513.1,6513.2,6524.0,6524.1,6527.0,6533.0,6534.0,6534.1,6535.0,6535.1,6536.0,6536.1,6537.0,6537.1,6539.0,6539.1,6540.0,6541.0,6544.0,6544.1,6545.0,6755.0,6760.0,6760.1,6760.2,6767.0,6775.0,6775.1,6776.0,6777.0,6777.1,6777.2,6778.0,6780.0,6780.1,6780.2,6784.0,6784.1,6784.2,6784.3,6785.0,6785.1,6785.2,6786.0,6787.0,6788.0,6788.1,6788.2,6788.3,6788.4,6790.0,6790.1,6792.0,6793.0,6793.1,6794.0,6794.1,6798.0,6921.0,6922.0,6923.0,6923.1,6924.0,6925.0,6925.1,6925.2,6925.3,6928.0,6929.0,6930.0,6930.1,6930.2,6934.0,6935.0,6936.1,6937.0,6939.0,6940.0,6940.1,6942.0,6942.1,6945.0,6946.0,6951.0,6952.0,6960.0,6960.1,6960.2,6961.0,6963.0,6966.0,6966.1,6966.2,6967.0,6968.0,6968.1,6968.2,6968.3,6968.4,6969.0,7203.0,9024.0,9025.0,9026.0,9027.0,9028.0,9029.0,9030.0,9033.0,9036.0,9037.0,9038.0,9039.0,9040.0,9041.0,9042.0,9043.0,9044.0,9045.0,9200.0,9203.0,9204.0,9226.0,9227.0,9228.0,9229.0,9230.0,9231.0,9233.0,9236.0,9237.0,9238.0,9239.0,9240.0,9241.0,9242.0,9243.0,9244.0,9245.0,9400.0,9400.1,9401.0,9401.1,9401.2,9402.0,9403.0,9403.1,9403.2,9404.0,9404.1,9405.0,9406.0,9407.0,9408.0,9409.0,9410.0,9411.0,9411.1,9411.2,9412.0,9412.1,9413.0,9414.0,9415.0,9416.0,9417.0,9418.0,9418.1,9419.0,9419.1,9420.0,9421.0,9422.0,9423.0,9423.1,9424.0,9425.0,9426.0,9427.0,9428.0,9429.0,9430.0,9430.1,9431.0,9432.0,9433.0,9433.1,9434.0,9435.0,9436.0,9437.0,9438.0,9439.0,9440.0,9441.0,9442.0,9443.0,9444.0,9445.0,9445.1,9445.2,9446.0,9447.0,9449.0,9450.0,9451.0,9452.0,9453.0,9454.0,9455.0,9456.0,9457.0,9458.0,9459.0,9460.0,9461.0,9462.0,9463.0,9464.0,9465.0,9466.0,9467.0,9468.0,9469.0,9470.0,9471.0,9472.0,9473.0,9474.0,9475.0,9476.0,9477.0,9478.0,9479.0,9480.0,9481.0,9482.0,9483.0,9484.0,9485.0,9486.0,9487.0,9488.0,9488.1,9489.0,9490.0,9491.0,9492.0,9493.0,9494.0,9495.0,9496.0,9497.0,9498.0,9499.0,9500.0,9501.0,9502.0,9503.0,9504.0,9505.0,9507.0,9508.0,9509.0,9510.0,9510.1,9511.0,9512.0,9513.0,9514.0,9515.0,9516.0,9517.0,9518.0,9519.0,9519.2,9520.0,9521.0,9522.0,9523.0,9524.0,9525.0,9527.0,9528.0,9529.0,9530.0,9531.0,9532.0,9533.0,9534.0,9535.0,9536.0,9537.0,9539.0,9540.0,9541.0,9542.0,9542.1,9543.0,9544.0,9545.0,9546.0,9546.1,9546.2,9547.0,9548.0,9549.0,9550.0,9551.0,9552.0,9553.0,9554.0,9555.0,9556.0,9557.0,9558.0,9559.0,9560.0,9560.1,9561.0,9562.0,9562.1,9563.0,9563.1,9564.0,9565.0,9566.0,9567.0,9567.1,9568.0,9570.0,9571.0,9572.0,9573.0,9574.0,9575.0,9576.0,9577.0,9578.0,9579.0,9580.0,9581.0,9582.0,9583.0,11004.0,11004.1,11011.0,11028.0,11029.0,12000.0,12001.0,12002.0,12002.1,12003.0,12004.0,12005.0,12005.1,12006.0,12007.0,12008.0,12009.0,12010.0,12011.0,12012.0,12013.0,12014.0,12014.1,12015.0,12015.1,12016.0,12017.0,12018.0,12019.0,12020.0,12021.0,12022.0,12022.1,12023.0,12023.1,12024.0,12025.0,12025.1,12026.0,12027.0</sig_subsig_ids>
      </category>
      <category name="Windows NT/2K/XP" cli_name="windows_nt/2k/xp">
        <category name="General Windows NT/2K/XP"  cli_name="general_windows_nt/2k/xp">
          <sigids>3052,3116,3119,3121,3123,3128,3129,3130,3131,3211,3214,3215,3220,3229,3234,3235,3236,3308,3309,3311,3314,3317,3318,3319,3321,3329,3330,3331,3332,3333,3334,3335,3338,3344,3346,3347,3353,3357,3453,3528,3530,3537,3540,3704,3718,3731,3732,4701,4702,4703,4704,5036,5051,5075,5081,5085,5114,5123,5124,5126,5147,5149,5150,5156,5176,5200,5203,5221,5246,5247,5248,5258,5259,5260,5261,5263,5280,5281,5282,5284,5289,5320,5344,5364,5365,5368,5371,5372,5373,5374,5376,5377,5379,5383,5385,5386,5391,5399,5405,5407,5408,5409,5418,5419,5420,5421,5422,5423,5428,5429,5431,5441,5476,5516,5527,5528,5580,5581,5583,5585,5586,5590,5591,5597,5598,5599,5601,5603,5672,5686,5693,5718,5728,5729,5738,5739,5749,5753,5766,5772,5775,5776,5793,5794,5797,5799,5802,5807,5814,5815,5822,5857,5858,5863,5864,5868,5869,6130,6131,6350,6771,9224,9225,11026</sigids>
          <sig_subsig_ids>3052.0,3116.0,3119.0,3121.0,3123.0,3128.0,3128.1,3129.0,3130.0,3131.0,3211.1,3211.2,3211.3,3214.0,3215.0,3220.0,3229.0,3234.1,3235.0,3235.1,3236.0,3308.0,3309.0,3311.0,3314.0,3314.1,3314.2,3317.0,3318.0,3319.0,3321.0,3329.0,3330.0,3331.0,3331.1,3331.2,3331.3,3331.4,3332.0,3333.0,3334.0,3334.1,3334.2,3334.3,3334.4,3334.5,3334.6,3334.7,3334.8,3335.0,3338.0,3338.1,3338.2,3338.3,3344.0,3346.0,3347.0,3347.1,3347.2,3353.0,3353.1,3353.2,3357.0,3453.0,3528.0,3530.0,3537.0,3540.0,3704.0,3718.0,3731.0,3732.0,4701.0,4702.0,4703.0,4704.0,5036.1,5036.2,5051.0,5051.1,5051.2,5075.0,5081.0,5085.0,5114.0,5114.1,5114.2,5114.3,5114.4,5114.5,5114.6,5114.7,5114.8,5123.0,5123.1,5123.2,5124.0,5124.1,5124.2,5126.0,5147.0,5149.0,5150.0,5156.0,5176.0,5200.0,5203.0,5221.0,5221.1,5221.2,5221.3,5221.4,5246.0,5247.0,5248.0,5258.0,5259.0,5260.0,5261.0,5263.0,5280.0,5281.0,5282.0,5282.1,5282.2,5284.0,5289.0,5320.0,5344.0,5364.0,5365.0,5368.0,5371.0,5372.0,5373.0,5374.0,5374.1,5376.0,5377.0,5379.0,5383.0,5383.1,5383.2,5385.0,5386.0,5391.0,5399.0,5405.0,5407.0,5408.0,5408.1,5409.0,5409.1,5418.0,5419.0,5420.0,5421.0,5422.0,5423.0,5428.0,5428.1,5429.0,5429.1,5431.0,5431.1,5441.0,5441.1,5476.0,5516.0,5527.0,5528.0,5580.0,5581.0,5583.0,5585.0,5586.0,5590.0,5591.0,5597.0,5598.0,5598.1,5599.0,5601.0,5603.0,5672.0,5686.0,5693.0,5693.1,5718.0,5728.0,5729.1,5738.0,5738.1,5738.2,5738.3,5738.4,5739.0,5739.1,5749.0,5753.0,5766.0,5772.0,5775.0,5775.1,5776.0,5776.1,5776.2,5793.0,5794.0,5794.1,5794.2,5797.0,5797.1,5797.2,5797.3,5799.0,5799.1,5799.2,5799.3,5799.4,5799.5,5799.6,5799.7,5802.0,5807.0,5814.0,5815.0,5815.1,5815.2,5822.0,5822.1,5822.2,5857.0,5857.1,5857.2,5858.0,5858.1,5858.2,5858.3,5858.4,5858.5,5863.0,5863.1,5863.2,5864.0,5868.0,5869.0,6130.0,6130.1,6130.2,6130.3,6130.4,6130.5,6130.6,6130.7,6130.8,6130.9,6130.10,6130.11,6131.0,6131.1,6131.2,6131.3,6131.4,6131.5,6131.6,6131.7,6350.0,6771.0,9224.0,9225.0,11026.0</sig_subsig_ids>
        </category>
        <category  name="WinNT"  cli_name="winnt">
          <sigids>3356,3466,5034,5044,5048,5049,5050,5070,5071,5120,5178,5266,5287</sigids>
          <sig_subsig_ids>3356.0,3466.0,5034.0,5044.0,5048.0,5049.0,5050.0,5070.0,5071.0,5120.0,5178.0,5266.0,5287.0</sig_subsig_ids>
        </category>
      </category>
    </category>
    <category  name="IOS"  cli_name="ios">
      <sigids>1109,3531,3532,3533,3600,3601,3602,3603,3604,3653,4062,4067,4500,4504,4505,4513,4600,4606,4619,5056,5129,5268,5324,5438,5508,5512,5684,5716,5796,5832,5835,5838,5860,5884,5893,5913,6004,6177,6178,6179,6926,6954,6973</sigids>
      <sig_subsig_ids>1109.0,1109.1,1109.2,1109.3,3531.0,3532.0,3533.0,3600.0,3601.0,3602.0,3603.0,3604.0,3653.0,4062.0,4067.0,4500.0,4500.1,4504.0,4505.0,4513.0,4600.0,4606.0,4606.1,4619.0,5056.0,5129.0,5268.0,5324.0,5438.0,5508.0,5512.0,5684.0,5684.1,5684.2,5684.3,5684.4,5684.5,5684.6,5716.0,5796.0,5832.0,5832.1,5832.2,5832.3,5835.0,5835.1,5835.2,5835.3,5835.4,5835.5,5835.6,5835.7,5838.0,5860.0,5860.1,5884.0,5884.1,5893.0,5893.1,5893.2,5913.0,5913.1,6004.0,6177.0,6178.0,6179.0,6926.0,6926.1,6954.1,6973.0</sig_subsig_ids>
    </category>
    <category  name="General OS"  cli_name="general_os">
      <sigids>1000,1001,1002,1003,1004,1005,1006,1007,1101,1102,1104,1107,1108,1200,1201,1202,1203,1204,1205,1206,1207,1208,1220,1225,1250,1300,1301,1302,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1330,1600,1601,1602,1603,1604,1605,1606,1607,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2100,2101,2102,2150,2151,2152,2153,2154,2155,2157,2202,3001,3002,3003,3005,3006,3010,3011,3012,3015,3016,3020,3021,3030,3031,3032,3033,3034,3035,3036,3037,3038,3039,3040,3041,3042,3043,3045,3046,3050,3051,3100,3101,3102,3103,3104,3106,3109,3110,3112,3113,3117,3120,3122,3127,3150,3151,3152,3153,3154,3157,3158,3159,3165,3166,3167,3168,3169,3173,3179,3180,3212,3213,3216,3217,3219,3221,3222,3227,3233,3250,3251,3253,3254,3407,3409,3454,3459,3465,3466,3529,3534,3551,3577,3578,3650,3651,3652,3654,3701,3702,3703,3705,3711,3714,3721,3728,3729,3730,3733,3738,3739,3782,3783,3784,3785,3786,3789,3790,3792,3802,3883,4001,4002,4003,4004,4050,4051,4052,4056,4061,4063,4100,4150,4501,4502,4506,4507,4508,4511,4512,4514,4515,4601,4603,4604,4605,4608,4609,4610,4611,4612,4613,4614,4620,5038,5040,5042,5043,5046,5047,5054,5055,5058,5060,5066,5067,5068,5073,5074,5076,5077,5079,5080,5083,5088,5089,5092,5093,5095,5096,5099,5100,5101,5102,5104,5105,5106,5113,5115,5116,5117,5118,5119,5121,5122,5125,5127,5128,5130,5131,5133,5138,5140,5141,5142,5151,5152,5154,5155,5159,5160,5161,5163,5164,5165,5166,5167,5170,5171,5173,5174,5175,5179,5180,5182,5183,5184,5188,5191,5194,5195,5197,5199,5201,5202,5206,5207,5209,5210,5211,5212,5213,5214,5215,5217,5219,5220,5222,5224,5229,5230,5231,5232,5233,5234,5237,5238,5240,5241,5243,5244,5245,5251,5252,5253,5256,5262,5269,5270,5271,5274,5275,5276,5277,5279,5283,5285,5286,5288,5290,5291,5293,5295,5296,5297,5298,5299,5301,5302,5304,5308,5310,5312,5313,5315,5317,5318,5319,5321,5322,5325,5327,5328,5331,5333,5334,5335,5336,5337,5340,5341,5342,5343,5345,5347,5349,5350,5352,5353,5354,5355,5356,5357,5366,5367,5370,5375,5378,5380,5381,5382,5388,5394,5397,5403,5411,5427,5432,5437,5440,5444,5445,5453,5455,5458,5459,5462,5464,5465,5466,5467,5468,5471,5473,5474,5475,5477,5479,5480,5481,5485,5490,5491,5504,5507,5511,5513,5514,5518,5521,5526,5529,5530,5535,5536,5537,5538,5539,5540,5541,5545,5553,5555,5558,5559,5565,5574,5606,5610,5612,5613,5614,5615,5616,5617,5618,5619,5620,5621,5622,5623,5624,5625,5626,5627,5628,5629,5630,5631,5632,5636,5638,5648,5650,5651,5652,5653,5654,5656,5657,5658,5662,5663,5664,5665,5667,5669,5671,5673,5674,5676,5677,5678,5679,5680,5685,5692,5697,5700,5701,5705,5710,5720,5722,5724,5725,5727,5733,5743,5744,5745,5746,5748,5750,5751,5752,5754,5756,5758,5759,5761,5763,5765,5768,5769,5773,5779,5780,5781,5782,5783,5784,5785,5786,5787,5788,5789,5790,5798,5801,5803,5804,5805,5810,5816,5818,5819,5820,5824,5825,5828,5830,5831,5833,5837,5841,5846,5847,5850,5851,5853,5854,5855,5861,5866,5879,5880,5890,5903,5909,5910,5912,5920,5921,5930,5931,5985,6003,6005,6008,6009,6050,6051,6052,6053,6054,6063,6065,6066,6120,6121,6181,6184,6186,6187,6234,6235,6236,6242,6250,6251,6252,6253,6255,6256,6260,6261,6267,6268,6269,6270,6412,6449,6501,6502,6503,6504,6505,6506,6507,6515,6517,6518,6520,6521,6522,6523,6526,6528,6530,6543,6761,6764,6768,6773,6781,6782,6799,6901,6902,6903,6910,6920,6931,6936,6944,6954,6959,6964,7000,7001,7101,7102,7104,7105,7201,7202,7205,9000,9001,9002,9003,9004,9005,9006,9007,9008,9009,9010,9011,9012,9013,9014,9015,9016,9017,9018,9019,9020,9021,9022,9023,9031,9032,9201,9202,9205,9206,9207,9208,9209,9210,9211,9212,9213,9214,9215,9216,9217,9218,9223,9232,9572,11000,11001,11002,11003,11005,11006,11007,11008,11009,11010,11011,11012,11013,11014,11015,11016,11017,11018,11019,11020,11021,11022,11023,11024,11025,11027,11030,11031,11200,11201,11202,11203,11204,11205,11206,11207,11208,11209,11210,11211,11212,11213,11214,11215,11216,11217,11218,11219,11221,11222,11223,11224,11225,11226,11227,11228,11229,11230,11231,11232,11233,11234,11235,11236,11237,11238,11239,11240,11241,11242,11244,11245,11246,11247,11248,11249,11250,11251,11252,12500,12501,12502,12503,12505,12621,12622,12623,12624,12626,12627,12628,12629,12631,12633,12634,12635,12636,12637,12638,12639,12641,12642,12643,12644,12645,12646,12648,12649,12650,12651,12652,12653,12654,12655,12656,12658,12659,12660,12661,12662,12663,12664,12665,12666,12667,12668,12669,12673,12674,12675,12676,12677,12678,12679,12680,12681,12682,12683,12685,12686,12687,12688,12689,12690,12693,12694,12695,12696,12697,12698,12699,12700,12701,12702,12703,12704,12705,12706,12707,12708,12709,12710,12711,12712,12713,12900,12901,12902,12903,12904,12905,12906,12907,12908,12909,12910,12911,12912,12913,12914,12915,12916,12917,12918,12919,12920,12921,12922,12923,12924,12925,12926,12927,12928,12929,12930,12931,12932,12933,13000,13001,13002,13003,13004,13005,13006,13007,13008,50000</sigids>
      <sig_subsig_ids>1000.0,1001.0,1002.0,1003.0,1004.0,1005.0,1006.0,1007.0,1101.0,1102.0,1104.0,1107.0,1108.0,1200.0,1201.0,1202.0,1203.0,1204.0,1205.0,1206.0,1207.0,1208.0,1220.0,1225.0,1250.0,1300.0,1301.0,1302.0,1303.0,1304.0,1305.0,1306.0,1306.1,1306.2,1306.3,1306.4,1306.5,1306.6,1307.0,1308.0,1309.0,1310.0,1311.0,1312.0,1313.0,1314.0,1315.0,1316.0,1330.0,1330.1,1330.2,1330.3,1330.4,1330.5,1330.6,1330.7,1330.8,1330.9,1330.10,1330.11,1330.12,1330.13,1330.14,1330.15,1330.16,1330.17,1330.18,1330.19,1330.20,1330.21,1600.0,1601.0,1602.0,1603.0,1604.0,1605.0,1606.0,1607.0,2000.0,2001.0,2001.1,2002.0,2003.0,2004.0,2005.0,2006.0,2007.0,2008.0,2009.0,2010.0,2011.0,2012.0,2100.0,2101.0,2102.0,2150.0,2151.0,2152.0,2153.0,2154.0,2155.0,2157.0,2202.0,3001.0,3002.0,3003.0,3005.0,3006.0,3010.0,3011.0,3012.0,3015.0,3016.0,3020.0,3021.0,3030.0,3031.0,3032.0,3033.0,3034.0,3035.0,3036.0,3037.0,3038.0,3039.0,3040.0,3041.0,3042.0,3043.0,3045.0,3046.0,3050.0,3051.0,3051.1,3100.0,3101.0,3102.0,3103.0,3103.1,3104.0,3104.1,3106.0,3109.0,3109.1,3110.0,3112.0,3113.0,3117.0,3117.1,3120.0,3120.1,3122.0,3127.0,3150.0,3150.1,3151.0,3152.0,3153.0,3154.0,3157.0,3158.0,3159.0,3165.0,3166.0,3167.0,3168.0,3169.0,3173.0,3179.0,3180.0,3180.1,3212.0,3213.0,3216.0,3217.0,3219.0,3221.0,3222.0,3227.0,3233.0,3250.0,3251.0,3253.0,3254.0,3254.1,3407.0,3409.0,3409.1,3409.2,3409.3,3454.0,3459.0,3459.1,3465.0,3466.0,3529.0,3534.0,3551.0,3577.0,3578.0,3650.0,3651.0,3652.0,3654.0,3701.0,3702.0,3703.0,3705.0,3711.0,3714.0,3721.0,3728.0,3729.0,3730.0,3733.0,3738.0,3739.0,3782.0,3783.0,3784.0,3785.0,3786.0,3789.0,3790.0,3792.0,3802.0,3883.0,4001.0,4002.0,4003.0,4004.0,4050.0,4051.1,4051.2,4051.3,4052.1,4052.2,4056.0,4061.0,4063.0,4100.0,4150.0,4501.0,4502.0,4506.0,4507.0,4507.1,4507.2,4507.3,4507.4,4507.5,4507.6,4507.7,4507.8,4507.9,4507.10,4507.11,4507.12,4507.13,4507.14,4507.15,4507.16,4507.17,4507.18,4507.19,4507.20,4507.21,4507.22,4507.23,4507.24,4507.25,4507.26,4507.27,4507.28,4507.29,4507.30,4507.31,4507.32,4507.33,4507.34,4507.35,4507.36,4507.37,4508.0,4511.0,4512.0,4514.0,4515.0,4515.1,4601.0,4601.1,4601.2,4601.3,4603.0,4604.0,4604.1,4605.0,4605.1,4608.0,4608.1,4608.2,4608.3,4608.4,4608.5,4609.0,4609.1,4610.0,4610.1,4611.0,4611.1,4612.0,4612.1,4613.0,4613.1,4614.0,4614.1,4620.0,5038.0,5040.1,5040.2,5040.3,5042.1,5042.2,5042.3,5042.4,5042.5,5042.6,5043.1,5043.2,5043.3,5046.0,5047.0,5054.0,5055.0,5058.0,5060.0,5066.0,5067.0,5068.0,5073.0,5074.0,5076.0,5077.0,5079.0,5080.0,5083.0,5088.0,5089.0,5092.0,5093.0,5095.0,5096.0,5099.0,5100.0,5101.0,5102.0,5104.0,5105.0,5106.0,5113.0,5115.0,5115.1,5115.2,5115.3,5115.4,5115.5,5115.6,5116.0,5117.0,5118.0,5119.0,5121.0,5122.0,5125.0,5127.0,5128.0,5130.0,5131.0,5133.0,5138.0,5140.0,5141.0,5142.0,5142.1,5151.0,5152.0,5154.0,5155.0,5159.0,5160.0,5161.0,5163.0,5164.0,5165.0,5166.0,5167.0,5170.0,5170.1,5171.0,5173.0,5174.0,5175.0,5179.0,5180.0,5182.0,5183.0,5184.0,5188.0,5188.1,5188.2,5188.3,5191.0,5194.0,5194.1,5194.2,5195.0,5197.0,5199.0,5201.0,5201.1,5201.2,5202.0,5202.1,5206.0,5207.0,5207.1,5209.0,5210.0,5210.1,5211.0,5212.0,5213.0,5214.0,5215.0,5215.1,5217.0,5219.0,5220.0,5222.0,5224.0,5229.0,5230.0,5231.0,5232.0,5232.1,5233.0,5234.0,5234.1,5237.0,5238.0,5240.0,5241.0,5243.0,5243.1,5243.2,5243.3,5243.4,5243.5,5243.6,5244.0,5245.0,5251.0,5252.0,5253.0,5256.0,5262.0,5269.0,5270.0,5271.0,5274.0,5274.1,5275.0,5275.1,5276.0,5276.1,5276.2,5277.0,5279.0,5283.0,5285.0,5286.0,5288.0,5290.0,5291.0,5293.0,5295.0,5296.0,5297.0,5298.0,5299.0,5301.0,5302.0,5304.0,5308.0,5310.0,5312.0,5313.0,5315.0,5317.0,5318.0,5319.0,5321.0,5322.0,5322.1,5325.0,5327.0,5328.0,5328.1,5331.0,5333.0,5333.1,5334.0,5335.0,5336.0,5337.0,5340.0,5341.0,5342.0,5343.0,5345.0,5347.0,5349.0,5350.0,5352.0,5353.0,5354.0,5355.0,5356.0,5357.0,5366.0,5366.1,5367.0,5370.0,5375.0,5378.0,5380.0,5381.0,5382.0,5388.0,5388.1,5388.2,5388.3,5394.0,5397.0,5403.0,5411.0,5427.0,5432.0,5437.0,5440.0,5444.0,5445.0,5453.0,5453.1,5455.0,5455.1,5458.0,5459.0,5459.1,5462.0,5464.0,5464.1,5464.2,5465.0,5466.0,5467.0,5468.0,5471.0,5471.1,5473.0,5474.0,5474.1,5475.0,5477.0,5477.1,5477.2,5479.0,5480.0,5481.0,5485.0,5485.1,5490.0,5491.0,5504.0,5507.0,5511.0,5513.0,5514.0,5514.1,5518.0,5521.0,5526.0,5529.0,5529.1,5529.2,5529.3,5530.0,5535.0,5536.0,5537.0,5538.0,5539.0,5540.0,5541.0,5545.0,5545.1,5553.0,5555.0,5558.0,5559.0,5565.0,5565.1,5565.3,5574.0,5606.0,5610.0,5612.0,5613.0,5614.0,5615.0,5616.0,5617.0,5618.0,5619.0,5619.1,5620.0,5621.0,5622.0,5623.0,5624.0,5625.0,5626.0,5627.0,5627.1,5628.0,5629.0,5630.0,5631.0,5632.0,5632.1,5636.0,5638.0,5648.0,5648.1,5650.0,5651.0,5651.1,5652.0,5653.0,5654.0,5656.0,5657.0,5658.0,5662.0,5663.0,5664.0,5665.0,5667.0,5669.0,5671.0,5673.0,5674.0,5676.0,5677.0,5678.0,5679.0,5680.0,5685.0,5692.0,5697.0,5700.0,5701.0,5701.1,5705.0,5710.0,5720.0,5722.0,5724.0,5725.0,5727.0,5733.0,5743.0,5744.0,5745.0,5746.0,5748.0,5748.1,5748.2,5748.3,5748.4,5748.5,5750.0,5751.0,5752.0,5754.0,5756.0,5758.0,5759.1,5759.2,5759.3,5761.0,5763.0,5765.0,5768.0,5769.0,5769.1,5773.0,5773.1,5779.0,5780.0,5781.0,5782.0,5783.0,5784.0,5785.0,5786.0,5787.0,5788.0,5789.0,5790.0,5798.0,5801.0,5801.1,5803.0,5804.0,5804.1,5804.2,5805.0,5805.1,5810.0,5816.0,5816.1,5818.0,5818.1,5818.2,5818.3,5818.4,5818.5,5818.6,5818.7,5818.8,5818.9,5818.10,5818.11,5819.0,5820.0,5824.0,5825.0,5828.0,5830.0,5831.0,5833.0,5837.0,5837.1,5841.0,5846.0,5847.0,5847.1,5850.0,5850.1,5851.0,5853.0,5854.0,5854.1,5855.0,5861.0,5861.1,5866.0,5879.0,5880.0,5890.0,5903.1,5909.0,5910.0,5912.0,5920.0,5921.0,5930.0,5930.1,5930.2,5930.3,5930.4,5930.5,5931.0,5931.1,5985.0,6003.0,6005.0,6008.0,6009.0,6050.0,6050.1,6051.0,6051.1,6052.0,6052.1,6053.0,6053.1,6054.0,6054.1,6063.0,6063.1,6065.0,6066.0,6120.1,6121.0,6121.1,6181.0,6184.0,6186.0,6187.0,6234.0,6235.0,6236.0,6242.0,6250.0,6251.0,6252.0,6253.0,6255.0,6256.0,6260.0,6261.0,6267.0,6268.0,6269.0,6270.0,6412.0,6449.0,6501.0,6502.0,6503.0,6504.0,6505.0,6505.1,6506.0,6506.1,6507.0,6515.0,6517.0,6518.0,6518.1,6520.0,6521.0,6522.0,6523.0,6526.0,6528.0,6530.0,6543.0,6761.0,6764.0,6764.1,6768.0,6768.1,6768.2,6773.0,6781.0,6782.0,6799.0,6901.0,6902.0,6903.0,6910.0,6920.0,6931.0,6936.0,6944.0,6954.0,6959.0,6964.0,7000.0,7001.0,7101.0,7102.0,7104.0,7105.0,7201.0,7202.0,7205.0,9000.0,9001.0,9002.0,9003.0,9004.0,9005.0,9006.0,9007.0,9008.0,9009.0,9010.0,9011.0,9012.0,9013.0,9014.0,9015.0,9016.0,9017.0,9018.0,9019.0,9020.0,9021.0,9022.0,9023.0,9031.0,9032.0,9201.0,9202.0,9205.0,9206.0,9207.0,9208.0,9209.0,9210.0,9211.0,9212.0,9213.0,9214.0,9215.0,9216.0,9217.0,9218.0,9223.0,9232.0,9572.0,11000.0,11000.1,11000.2,11000.3,11001.0,11001.1,11002.0,11002.1,11003.0,11003.1,11005.0,11005.1,11005.2,11006.0,11006.1,11007.0,11007.1,11008.0,11008.1,11009.0,11009.1,11010.0,11010.1,11011.1,11012.0,11012.1,11013.0,11013.1,11014.0,11015.0,11016.0,11017.0,11017.1,11018.0,11018.1,11019.0,11019.1,11020.0,11020.1,11021.0,11022.0,11022.1,11023.0,11023.1,11024.0,11025.0,11027.0,11027.1,11030.0,11031.0,11200.0,11201.0,11202.0,11203.0,11204.0,11205.0,11206.0,11207.0,11208.0,11209.0,11210.0,11210.1,11211.0,11211.1,11212.0,11213.0,11214.0,11215.0,11216.0,11217.0,11218.0,11219.0,11221.0,11222.0,11223.0,11224.0,11225.0,11226.0,11227.0,11228.0,11229.0,11230.0,11231.0,11232.0,11233.0,11233.1,11233.2,11233.3,11234.0,11235.0,11236.0,11237.0,11238.0,11239.0,11240.0,11241.0,11242.0,11244.0,11245.0,11245.1,11245.2,11245.3,11246.0,11247.0,11248.0,11249.0,11250.0,11251.0,11252.0,11252.1,12500.1,12500.2,12500.3,12500.4,12500.5,12500.6,12500.7,12500.8,12500.9,12500.10,12501.0,12501.1,12501.2,12501.3,12501.4,12501.5,12501.6,12501.7,12501.8,12501.9,12501.10,12501.11,12501.12,12501.13,12501.14,12501.15,12501.16,12501.17,12501.18,12501.19,12501.20,12501.21,12501.22,12501.23,12501.24,12501.25,12501.26,12501.27,12501.28,12501.29,12501.30,12501.31,12501.32,12501.33,12501.34,12501.35,12501.36,12501.37,12501.38,12501.39,12501.40,12501.41,12501.42,12502.0,12502.1,12502.2,12502.3,12502.4,12502.6,12503.1,12503.2,12503.3,12503.4,12505.1,12505.2,12505.3,12505.4,12505.5,12505.6,12621.0,12621.1,12621.2,12622.0,12622.1,12622.2,12623.0,12623.1,12623.2,12624.0,12624.1,12624.2,12626.0,12626.1,12626.2,12627.0,12627.1,12627.2,12628.0,12628.1,12628.2,12629.0,12629.1,12631.0,12631.1,12633.0,12633.1,12633.2,12634.0,12634.1,12634.2,12635.0,12635.1,12635.2,12636.0,12636.1,12636.2,12637.0,12637.1,12637.2,12638.0,12638.1,12638.2,12639.0,12639.1,12639.2,12641.0,12641.1,12641.2,12642.0,12642.1,12643.0,12643.1,12644.0,12644.1,12645.0,12645.1,12645.2,12646.0,12646.1,12646.2,12648.0,12648.1,12648.2,12649.0,12649.1,12649.2,12650.0,12650.1,12651.0,12651.1,12651.2,12652.0,12652.1,12652.2,12653.0,12653.1,12654.0,12654.1,12654.2,12655.0,12655.1,12655.2,12656.0,12656.1,12656.2,12658.0,12658.1,12659.0,12659.1,12660.0,12660.1,12660.2,12661.0,12661.1,12662.0,12662.1,12663.0,12663.1,12663.2,12664.0,12664.1,12664.2,12665.0,12665.1,12666.0,12666.1,12667.0,12667.1,12667.2,12668.0,12668.1,12669.0,12669.1,12673.0,12674.0,12675.0,12676.0,12677.0,12678.0,12679.0,12680.0,12681.0,12682.0,12683.0,12685.0,12686.0,12687.0,12688.0,12689.0,12690.0,12693.0,12694.0,12695.0,12696.0,12697.0,12698.0,12699.0,12700.0,12701.0,12702.0,12703.0,12704.0,12705.0,12706.0,12707.0,12708.0,12709.0,12710.0,12711.0,12712.0,12713.0,12900.0,12901.0,12902.0,12903.0,12904.0,12905.0,12906.0,12907.0,12908.0,12909.0,12910.0,12911.0,12912.0,12913.0,12914.0,12915.0,12916.0,12917.0,12918.0,12919.0,12920.0,12921.0,12922.0,12923.0,12924.0,12925.0,12926.0,12927.0,12928.0,12929.0,12930.0,12931.0,12932.0,12933.0,13000.0,13000.1,13001.0,13001.1,13002.0,13002.1,13003.0,13003.1,13004.0,13004.1,13005.0,13005.1,13006.0,13006.1,13007.0,13007.1,13008.0,13008.1,50000.0,50000.1,50000.2</sig_subsig_ids>
    </category>
    <category  name="Netware"  cli_name="netware">
      <sigids>3231,5760,6769</sigids>
      <sig_subsig_ids>3231.0,5760.0,6769.0</sig_subsig_ids>
    </category>
    <category  name="Mac OS"  cli_name="mac_os">
      <sigids>5134,5181,5235,5430,5486,5645,6228</sigids>
      <sig_subsig_ids>5134.0,5181.1,5235.0,5430.0,5430.1,5430.2,5486.0,5486.1,5645.0,6228.0,6228.1,6228.2,6228.3</sig_subsig_ids>
    </category>
  </category>
  <category name="Attack" cli_name="attack">
    <category  name="Command Execution"  cli_name="command_execution">
      <sigids>3150,3181,3225,3227,3254,3325,3340,3347,3352,3404,3653,3732,3736,3787,3789,3790,3883,4514,5307,5316,5348,5350,5353,5355,5356,5357,5358,5368,5369,5374,5378,5380,5381,5386,5389,5401,5408,5445,5453,5473,5474,5482,5494,5498,5500,5513,5523,5551,5558,5574,5588,5610,5634,5638,5639,5642,5645,5650,5655,5675,5685,5687,5703,5705,5720,5722,5754,5757,5776,5790,5796,5798,5803,5804,5805,5807,5827,5877,5916,5930,5931,6004,6008,6011,6203,6246,6249,6259,6546,6790,6936</sigids>
      <sig_subsig_ids>3150.1,3181.0,3225.0,3227.0,3254.0,3254.1,3325.0,3340.0,3347.0,3347.1,3347.2,3352.0,3404.1,3653.0,3732.0,3736.0,3787.0,3789.0,3790.0,3883.0,4514.0,5307.0,5316.0,5348.0,5350.0,5353.0,5355.0,5356.0,5357.0,5358.0,5368.0,5369.0,5374.0,5374.1,5374.2,5378.0,5380.0,5381.0,5386.0,5389.0,5401.0,5408.0,5408.1,5445.0,5453.0,5453.1,5473.0,5474.0,5482.0,5494.0,5498.0,5500.0,5513.0,5523.0,5551.0,5558.0,5574.0,5588.0,5610.0,5634.0,5638.0,5639.0,5642.2,5645.0,5650.0,5655.0,5675.0,5685.0,5687.0,5703.0,5705.0,5720.0,5722.0,5754.0,5757.0,5776.3,5790.0,5796.0,5798.0,5803.0,5804.0,5805.0,5807.0,5827.0,5877.0,5916.0,5930.0,5930.1,5930.2,5930.3,5930.4,5930.5,5931.1,6004.0,6008.0,6011.0,6203.0,6203.1,6246.1,6249.0,6259.0,6546.0,6790.0,6790.1,6936.0</sig_subsig_ids>
    </category>
    <category  name="General Attack"  cli_name="general_attack">
      <sigids>1000,1003,1005,1006,1200,1225,1250,1301,1302,1303,1304,1305,1306,1307,1310,1330,1607,2100,2101,2102,2152,2153,2154,2155,3151,3152,3153,3154,3157,3175,3180,3201,3220,3250,3251,3255,3301,3310,3316,3323,3339,3341,3344,3345,3346,3356,3357,3400,3401,3450,3453,3466,3530,3531,3532,3533,3603,3782,3990,3991,3992,4002,4004,4050,4051,4052,4053,4055,4058,4060,4062,4063,4067,4068,4100,4101,4150,4151,4500,4502,4511,4601,5039,5043,5044,5045,5049,5051,5052,5053,5054,5056,5060,5067,5076,5077,5083,5086,5087,5091,5092,5093,5095,5096,5097,5099,5100,5102,5111,5114,5119,5124,5130,5131,5140,5146,5149,5151,5163,5164,5165,5166,5169,5176,5177,5184,5188,5196,5201,5206,5209,5212,5219,5222,5230,5232,5234,5236,5237,5253,5256,5259,5260,5261,5262,5265,5269,5295,5315,5324,5325,5328,5341,5342,5345,5346,5367,5373,5382,5385,5390,5395,5400,5402,5403,5411,5417,5418,5419,5420,5421,5422,5427,5428,5430,5438,5447,5448,5449,5450,5451,5457,5458,5459,5460,5462,5464,5469,5472,5474,5492,5497,5505,5506,5508,5511,5512,5514,5516,5518,5519,5521,5524,5529,5531,5532,5533,5541,5543,5544,5545,5546,5555,5565,5567,5568,5570,5571,5572,5582,5592,5602,5609,5641,5648,5651,5656,5658,5671,5676,5680,5684,5706,5715,5716,5723,5724,5727,5728,5733,5743,5744,5745,5748,5750,5753,5756,5759,5769,5775,5784,5785,5786,5787,5788,5797,5800,5809,5812,5825,5829,5835,5837,5838,5841,5853,5854,5861,5864,5868,5893,5894,5903,5905,5909,5912,5913,5919,6003,6009,6050,6051,6052,6053,6054,6058,6061,6062,6064,6065,6066,6067,6100,6101,6102,6110,6111,6112,6113,6114,6115,6116,6117,6118,6120,6121,6122,6123,6124,6125,6126,6127,6128,6150,6177,6178,6179,6181,6184,6187,6257,6261,6263,6300,6302,6303,6412,6515,6518,6520,6521,6522,6523,6539,6540,6755,6764,6765,6792,6799,6926,7101,7102,7104,7105,9000,9001,9002,9003,9004,9005,9006,9007,9008,9009,9010,9011,9012,9013,9014,9015,9016,9017,9018,9019,9020,9021,9022,9031,9032,9033,9036,9037,9038,9039,9040,9041,9042,9043,9044,9045,9200,9201,9202,9203,9204,9205,9206,9207,9208,9209,9210,9211,9212,9213,9214,9215,9216,9217,9218,9223,9224,9225,9226,9227,9228,9229,9230,9231,9232,9233,9236,9237,9238,9239,9240,9241,9242,9243,9244,9245,9400,9401,9402,9403,9404,9405,9406,9407,9408,9409,9410,9411,9412,9413,9414,9415,9416,9417,9418,9419,9420,9421,9422,9423,9424,9425,9426,9427,9428,9429,9430,9431,9432,9433,9434,9435,9436,9437,9438,9439,9440,9441,9442,9443,9444,9445,9446,9447,9449,9450,9451,9452,9453,9454,9455,9456,9457,9458,9459,9460,9461,9462,9463,9464,9465,9466,9467,9468,9469,9470,9471,9472,9473,9474,9475,9476,9477,9478,9479,9480,9481,9482,9483,9484,9485,9486,9487,9488,9489,9490,9491,9492,9493,9494,9495,9496,9497,9498,9499,9500,9501,9502,9503,9504,9505,9506,9507,9508,9509,9510,9511,9512,9513,9514,9515,9516,9517,9518,9519,9520,9521,9522,9523,9524,9525,9527,9528,9529,9530,9531,9532,9533,9534,9535,9536,9537,9538,9539,9540,9541,9542,9543,9544,9545,9546,9547,9548,9549,9550,9551,9552,9553,9554,9555,9556,9557,9558,9559,9560,9561,9562,9563,9564,9565,9566,9567,9568,9570,9571,9572,9573,9574,9575,9576,9577,9578,9579,9580,9581,9582,9583,13000,13001,13002,13003,13004,13005,13006,13007,13008,50000</sigids>
      <sig_subsig_ids>1000.0,1003.0,1005.0,1006.0,1200.0,1225.0,1250.0,1301.0,1302.0,1303.0,1304.0,1305.0,1306.0,1306.1,1306.2,1306.3,1306.4,1306.5,1307.0,1310.0,1330.17,1607.0,2100.0,2101.0,2102.0,2152.0,2153.0,2154.0,2155.0,3151.0,3152.0,3153.0,3154.0,3157.0,3175.0,3180.1,3201.1,3201.2,3201.3,3201.4,3201.5,3201.6,3220.0,3250.0,3251.0,3255.0,3301.0,3310.0,3316.0,3323.0,3339.0,3341.0,3344.0,3345.0,3346.0,3356.0,3357.0,3400.0,3401.0,3401.1,3450.0,3453.0,3466.0,3530.0,3531.0,3532.0,3533.0,3603.0,3782.0,3990.1,3990.2,3991.0,3992.1,3992.2,3992.3,3992.4,3992.5,4002.0,4004.0,4050.0,4051.1,4051.2,4052.1,4052.2,4053.0,4055.1,4055.2,4058.0,4058.1,4060.0,4060.1,4062.0,4063.0,4067.0,4068.0,4100.0,4101.0,4150.0,4151.0,4151.1,4500.0,4502.0,4511.0,4601.0,5039.0,5043.1,5043.2,5043.3,5044.0,5045.0,5049.0,5051.0,5051.1,5051.2,5052.0,5053.0,5054.0,5056.0,5060.0,5067.0,5076.0,5077.0,5083.0,5086.0,5087.0,5087.1,5091.0,5091.1,5092.0,5093.0,5095.0,5096.0,5097.0,5097.1,5097.2,5099.0,5100.0,5102.0,5111.0,5114.0,5114.1,5114.2,5114.3,5114.4,5114.5,5114.6,5114.7,5114.8,5119.0,5124.0,5124.1,5124.2,5130.0,5131.0,5140.0,5146.0,5146.1,5146.2,5146.3,5146.4,5146.5,5146.6,5146.7,5146.8,5146.9,5146.10,5146.11,5146.12,5146.13,5146.14,5146.15,5146.16,5146.17,5149.0,5151.0,5163.0,5164.0,5165.0,5166.0,5169.0,5176.0,5177.0,5177.1,5184.0,5188.0,5188.1,5188.2,5188.3,5196.0,5196.1,5201.0,5201.1,5201.2,5206.0,5209.0,5212.0,5219.0,5222.0,5230.0,5232.0,5234.0,5234.1,5236.0,5237.0,5253.0,5256.0,5259.0,5260.0,5261.0,5262.0,5265.0,5269.0,5295.0,5315.0,5324.0,5325.0,5328.0,5328.1,5341.0,5342.0,5345.0,5346.0,5367.0,5373.0,5382.0,5385.0,5390.0,5395.0,5400.0,5402.0,5403.0,5411.0,5417.0,5418.0,5419.0,5420.0,5421.0,5422.0,5427.0,5428.0,5428.1,5430.0,5430.1,5430.2,5438.0,5447.0,5448.0,5449.0,5450.0,5451.0,5457.0,5458.0,5459.0,5459.1,5460.0,5462.0,5464.1,5464.2,5469.1,5472.0,5474.1,5492.0,5497.0,5505.0,5505.1,5506.0,5506.1,5508.0,5511.0,5512.0,5514.0,5514.1,5516.0,5518.0,5519.0,5521.0,5524.0,5529.0,5529.1,5529.2,5529.3,5531.0,5532.0,5533.0,5541.0,5543.0,5544.0,5545.0,5545.1,5546.0,5555.0,5565.1,5567.0,5567.1,5567.2,5567.3,5567.4,5567.5,5567.6,5567.7,5567.8,5568.0,5570.0,5571.0,5572.0,5582.0,5592.0,5602.0,5609.0,5641.2,5648.0,5648.1,5651.0,5651.1,5656.0,5658.0,5671.0,5676.0,5680.0,5684.0,5684.1,5684.3,5684.5,5684.6,5706.0,5715.0,5716.0,5723.0,5724.0,5727.0,5728.0,5733.0,5743.0,5744.0,5745.0,5748.0,5748.1,5748.2,5748.3,5748.4,5748.5,5750.0,5753.0,5756.0,5759.0,5759.1,5759.2,5759.3,5769.0,5769.1,5775.0,5775.1,5784.0,5785.0,5786.0,5787.0,5788.0,5797.0,5797.1,5797.2,5797.3,5800.0,5809.0,5809.1,5809.2,5809.3,5812.0,5812.1,5825.0,5829.0,5835.0,5835.1,5835.2,5835.3,5835.4,5835.5,5835.6,5837.0,5838.0,5841.0,5853.0,5854.0,5854.1,5861.0,5861.1,5864.0,5868.0,5893.0,5894.0,5894.1,5903.0,5903.1,5903.2,5905.0,5905.1,5909.0,5912.0,5913.0,5913.1,5919.0,6003.0,6009.0,6050.0,6050.1,6051.0,6052.0,6052.1,6053.0,6053.1,6054.0,6054.1,6058.0,6058.1,6061.0,6061.1,6062.0,6062.1,6064.0,6065.0,6066.0,6067.0,6100.0,6100.1,6101.0,6101.1,6102.0,6102.1,6110.0,6110.1,6111.0,6111.1,6112.0,6112.1,6113.0,6113.1,6114.0,6114.1,6115.0,6115.1,6116.0,6116.1,6117.0,6117.1,6118.0,6118.1,6120.0,6120.1,6121.0,6121.1,6122.0,6122.1,6123.0,6123.1,6124.0,6124.1,6125.0,6125.1,6126.0,6126.1,6127.0,6127.1,6128.0,6128.1,6150.0,6150.1,6177.0,6178.0,6179.0,6181.0,6184.0,6187.0,6257.0,6261.0,6263.0,6300.0,6302.0,6303.0,6412.0,6515.0,6518.1,6520.0,6521.0,6522.0,6523.0,6539.0,6539.1,6540.0,6755.0,6764.0,6764.1,6765.0,6792.0,6799.0,6926.0,6926.1,7101.0,7102.0,7104.0,7105.0,9000.0,9001.0,9002.0,9003.0,9004.0,9005.0,9006.0,9007.0,9008.0,9009.0,9010.0,9011.0,9012.0,9013.0,9014.0,9015.0,9016.0,9017.0,9018.0,9019.0,9020.0,9021.0,9022.0,9031.0,9032.0,9033.0,9036.0,9037.0,9038.0,9039.0,9040.0,9041.0,9042.0,9043.0,9044.0,9045.0,9200.0,9201.0,9202.0,9203.0,9204.0,9205.0,9206.0,9207.0,9208.0,9209.0,9210.0,9211.0,9212.0,9213.0,9214.0,9215.0,9216.0,9217.0,9218.0,9223.0,9224.0,9225.0,9226.0,9227.0,9228.0,9229.0,9230.0,9231.0,9232.0,9233.0,9236.0,9237.0,9238.0,9239.0,9240.0,9241.0,9242.0,9243.0,9244.0,9245.0,9400.0,9400.1,9401.0,9401.1,9401.2,9402.0,9403.0,9403.1,9403.2,9404.0,9404.1,9405.0,9406.0,9407.0,9408.0,9409.0,9410.0,9411.0,9411.1,9411.2,9412.0,9412.1,9413.0,9414.0,9415.0,9416.0,9417.0,9418.0,9418.1,9419.0,9419.1,9420.0,9421.0,9422.0,9423.0,9423.1,9424.0,9425.0,9426.0,9427.0,9428.0,9429.0,9430.0,9430.1,9431.0,9432.0,9433.0,9433.1,9434.0,9435.0,9436.0,9437.0,9438.0,9439.0,9440.0,9441.0,9442.0,9443.0,9444.0,9445.0,9445.1,9445.2,9446.0,9447.0,9449.0,9450.0,9451.0,9452.0,9453.0,9454.0,9455.0,9456.0,9457.0,9458.0,9459.0,9460.0,9461.0,9462.0,9463.0,9464.0,9465.0,9466.0,9467.0,9468.0,9469.0,9470.0,9471.0,9472.0,9473.0,9473.1,9474.0,9475.0,9476.0,9477.0,9478.0,9479.0,9480.0,9481.0,9482.0,9483.0,9484.0,9485.0,9486.0,9487.0,9488.0,9488.1,9489.0,9490.0,9491.0,9492.0,9493.0,9494.0,9495.0,9496.0,9497.0,9498.0,9499.0,9500.0,9501.0,9502.0,9503.0,9504.0,9505.0,9506.0,9507.0,9508.0,9509.0,9510.0,9510.1,9511.0,9512.0,9513.0,9514.0,9515.0,9516.0,9517.0,9518.0,9519.0,9519.1,9519.2,9520.0,9521.0,9522.0,9523.0,9524.0,9525.0,9527.0,9528.0,9529.0,9530.0,9531.0,9532.0,9533.0,9534.0,9535.0,9536.0,9537.0,9538.0,9539.0,9540.0,9541.0,9542.0,9542.1,9543.0,9544.0,9545.0,9546.0,9546.1,9546.2,9547.0,9548.0,9549.0,9550.0,9551.0,9552.0,9553.0,9554.0,9555.0,9556.0,9557.0,9558.0,9559.0,9560.0,9560.1,9560.2,9561.0,9562.0,9562.1,9563.0,9563.1,9564.0,9565.0,9566.0,9567.0,9567.1,9568.0,9570.0,9571.0,9572.0,9573.0,9574.0,9575.0,9576.0,9577.0,9578.0,9579.0,9580.0,9581.0,9582.0,9583.0,13000.0,13000.1,13001.0,13001.1,13002.1,13003.0,13003.1,13004.0,13004.1,13005.1,13006.1,13007.1,13008.0,13008.1,50000.0,50000.1,50000.2</sig_subsig_ids>
    </category>
    <category  name="Informational"  cli_name="informational">
      <sigids>1007,1101,1104,1107,1108,1309,1311,1312,1313,1314,1315,1316,1330,1600,1601,1602,1603,1604,1605,1606,1607,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2150,2151,3103,3104,3106,3166,3167,3171,3232,3302,3303,3304,3308,3309,3313,3315,3317,3318,3319,3321,3327,3334,3343,3348,3349,3350,3351,3353,3454,3456,3461,3462,3463,3464,3465,3502,3551,3702,4001,4003,4054,4500,4501,4503,4504,4505,4506,4507,4508,4512,4515,4516,4603,4604,4605,4610,4611,4612,4620,5037,5046,5063,5079,5080,5103,5104,5107,5108,5110,5134,5229,5327,5493,5499,5500,5501,5502,5503,5520,5530,5556,5557,5561,5565,5566,5575,5576,5580,5581,5585,5587,5590,5591,5603,5605,5606,5612,5613,5614,5615,5616,5617,5618,5620,5621,5622,5623,5624,5625,5626,5628,5629,5630,5631,5635,5641,5642,5644,5710,5711,5726,5731,5732,5738,5739,5747,5776,5779,5780,5781,5782,5783,5789,5794,5799,5804,5805,5816,5827,5837,5846,5847,5893,5918,5931,6017,6063,6069,6103,6104,6105,6120,6121,6122,6123,6124,6125,6126,6127,6128,6130,6131,6228,6229,6250,6251,6252,6253,6255,6256,6278,6298,6403,6408,6409,6410,6509,6510,6512,6513,6524,6534,6535,6536,6760,6768,6780,6785,6788,6794,6923,6925,6930,6940,6960,6966,6968,7000,7001,12621,12622,12623,12624,12626,12627,12628,12629,12631,12633,12634,12635,12636,12637,12638,12639,12641,12642,12643,12644,12645,12646,12648,12649,12650,12651,12652,12653,12654,12655,12656,12658,12659,12660,12661,12662,12663,12664,12665,12666,12667,12668,12669,12673,12677,12678,12679,12680,12681,12682,12683,12685,12686,12688,12689,12690,12693,12695,12696,12697,12698,12699,12700,12701,12702,12703,12704,12705,12706,12707,12708,12709,12710,12711,12712,12901,12902,12903,12904,12905,12906,12907,12908,12909,12910,12911,12912,12913,12914,12915,12916,12917,12918,12919,12920,12921,12922,12923,12924,12925,12926,12927,12928,12929,12930,12931,12932,12933,13002,13005,13006,13007</sigids>
      <sig_subsig_ids>1007.0,1101.0,1104.0,1107.0,1108.0,1309.0,1311.0,1312.0,1313.0,1314.0,1315.0,1316.0,1330.0,1330.1,1330.2,1330.3,1330.4,1330.5,1330.6,1330.7,1330.9,1330.10,1330.11,1330.12,1330.13,1330.14,1330.15,1330.16,1330.18,1330.19,1330.20,1330.21,1600.0,1601.0,1602.0,1603.0,1604.0,1605.0,1606.0,1607.0,2000.0,2001.0,2001.1,2002.0,2003.0,2004.0,2005.0,2006.0,2007.0,2008.0,2009.0,2010.0,2011.0,2012.0,2150.0,2151.0,3103.0,3103.1,3104.0,3104.1,3106.0,3166.0,3167.0,3171.0,3171.1,3232.0,3302.0,3303.0,3304.0,3308.0,3309.0,3313.0,3315.0,3317.0,3318.0,3319.0,3321.0,3327.7,3327.9,3327.10,3327.13,3334.2,3334.7,3343.0,3348.0,3349.0,3350.0,3351.0,3353.0,3454.0,3456.0,3456.1,3456.3,3461.0,3462.0,3463.0,3464.0,3465.0,3502.0,3551.0,3702.0,4001.0,4003.0,4054.0,4054.1,4500.1,4501.0,4503.0,4503.1,4504.0,4505.0,4506.0,4507.0,4507.1,4507.2,4507.3,4507.4,4507.5,4507.6,4507.7,4507.8,4507.9,4507.10,4507.11,4507.12,4507.13,4507.14,4507.15,4507.16,4507.17,4507.18,4507.19,4507.20,4507.21,4507.22,4507.23,4507.24,4507.25,4507.26,4507.27,4507.28,4507.29,4507.30,4507.31,4507.32,4507.33,4507.34,4507.35,4507.36,4507.37,4508.0,4512.0,4515.0,4515.1,4516.0,4603.0,4604.0,4604.1,4605.0,4605.1,4610.0,4610.1,4611.0,4611.1,4612.0,4620.0,5037.0,5046.0,5063.0,5079.0,5080.0,5103.0,5104.0,5107.0,5108.0,5108.1,5108.2,5110.0,5134.0,5229.0,5327.0,5493.0,5499.0,5500.0,5501.0,5502.0,5502.1,5502.2,5502.3,5502.4,5503.0,5520.0,5530.0,5556.2,5557.0,5557.1,5561.1,5561.2,5565.0,5565.3,5566.0,5575.0,5576.0,5580.0,5581.0,5585.0,5587.0,5590.0,5590.1,5591.1,5603.0,5605.0,5606.0,5612.0,5613.0,5614.0,5615.0,5616.0,5617.0,5618.0,5620.0,5621.0,5622.0,5623.0,5624.0,5625.0,5626.0,5628.0,5629.0,5630.0,5631.0,5635.0,5635.1,5641.0,5641.1,5642.0,5642.1,5642.2,5644.0,5644.1,5644.2,5710.0,5711.0,5726.0,5726.1,5731.1,5731.2,5732.1,5732.2,5738.1,5739.0,5739.1,5747.1,5747.2,5776.1,5776.2,5779.0,5780.0,5781.0,5782.0,5783.0,5789.0,5794.1,5794.2,5799.1,5799.2,5799.3,5799.5,5799.6,5804.1,5804.2,5805.1,5816.0,5816.1,5827.1,5827.2,5837.1,5846.0,5847.0,5847.1,5893.1,5893.2,5918.1,5931.0,6017.1,6017.2,6017.4,6017.5,6063.0,6063.1,6069.1,6069.2,6069.3,6069.5,6069.7,6069.8,6103.0,6103.1,6104.0,6104.1,6105.0,6105.1,6120.0,6120.1,6121.0,6121.1,6122.0,6122.1,6123.0,6123.1,6124.0,6124.1,6125.0,6125.1,6126.0,6126.1,6127.0,6127.1,6128.0,6128.1,6130.1,6130.2,6130.4,6130.6,6130.7,6130.8,6130.10,6131.0,6131.1,6131.3,6131.4,6131.6,6228.1,6228.2,6228.3,6229.1,6229.2,6250.0,6251.0,6252.0,6253.0,6255.0,6256.0,6278.1,6278.2,6298.1,6403.1,6408.1,6409.1,6409.2,6410.1,6410.2,6509.1,6509.2,6510.1,6510.2,6512.1,6512.2,6513.1,6513.2,6524.1,6534.1,6535.1,6536.1,6760.1,6760.2,6768.1,6768.2,6780.1,6785.1,6785.2,6788.1,6788.2,6788.4,6794.1,6923.1,6925.1,6925.2,6925.3,6930.1,6930.2,6940.1,6960.1,6960.2,6966.1,6966.2,6968.1,6968.3,6968.4,7000.0,7001.0,12621.0,12622.0,12623.0,12624.0,12626.0,12627.0,12628.0,12629.0,12631.0,12633.0,12634.0,12635.0,12636.0,12637.0,12638.0,12639.0,12641.0,12642.0,12643.0,12644.0,12645.0,12646.0,12648.0,12649.0,12650.0,12651.0,12652.0,12653.0,12654.0,12655.0,12656.0,12658.0,12659.0,12660.0,12661.0,12662.0,12663.0,12664.0,12665.0,12666.0,12667.0,12668.0,12669.0,12673.0,12677.0,12678.0,12679.0,12680.0,12681.0,12682.0,12683.0,12685.0,12686.0,12688.0,12689.0,12690.0,12693.0,12695.0,12696.0,12697.0,12698.0,12699.0,12700.0,12701.0,12702.0,12703.0,12704.0,12705.0,12706.0,12707.0,12708.0,12709.0,12710.0,12711.0,12712.0,12901.0,12902.0,12903.0,12904.0,12905.0,12906.0,12907.0,12908.0,12909.0,12910.0,12911.0,12912.0,12913.0,12914.0,12915.0,12916.0,12917.0,12918.0,12919.0,12920.0,12921.0,12922.0,12923.0,12924.0,12925.0,12926.0,12927.0,12928.0,12929.0,12930.0,12931.0,12932.0,12933.0,13002.0,13005.0,13006.0,13007.0</sig_subsig_ids>
    </category>
    <category  name="File Access"  cli_name="file_access">
      <sigids>3164,3210,3211,3212,3213,3214,3216,3217,3221,3222,3236,3305,3306,3307,3311,3312,3320,3322,3326,3451,3791,5038,5109,5141,5142,5147,5148,5154,5155,5157,5160,5168,5170,5172,5174,5178,5179,5180,5181,5194,5195,5200,5202,5203,5205,5207,5210,5211,5214,5215,5216,5217,5221,5231,5251,5252,5258,5263,5266,5270,5271,5272,5273,5278,5280,5281,5282,5284,5287,5288,5290,5291,5292,5293,5294,5296,5297,5298,5299,5300,5301,5302,5304,5305,5306,5310,5311,5313,5316,5319,5320,5323,5331,5333,5334,5335,5336,5337,5338,5339,5340,5349,5359,5370,5371,5372,5423,5467,5509,5510,5578,5579,5583,5584,5589,5591,5595,5608,5633,5637,5652,5653,5654,5666,5668,5738,5753,5772,5773,5778,5828,5851,5860,6068,6188,6271,6513,6528</sigids>
      <sig_subsig_ids>3164.0,3210.0,3210.1,3210.2,3210.3,3211.0,3211.1,3211.2,3211.3,3212.0,3213.0,3214.0,3216.0,3217.0,3221.0,3222.0,3236.0,3305.0,3306.0,3307.0,3311.0,3312.0,3320.0,3322.0,3326.0,3451.0,3791.0,5038.0,5109.0,5109.1,5141.0,5142.0,5142.1,5147.0,5148.0,5154.0,5155.0,5157.0,5160.0,5168.0,5170.0,5170.1,5172.0,5174.0,5178.0,5179.0,5180.0,5181.0,5181.1,5194.1,5194.2,5195.0,5200.0,5202.0,5202.1,5203.0,5205.0,5207.0,5207.1,5210.0,5210.1,5211.0,5214.0,5215.0,5216.0,5216.1,5217.0,5221.0,5221.1,5221.2,5221.3,5221.4,5231.0,5251.0,5252.0,5258.0,5263.0,5266.0,5270.0,5271.0,5272.0,5273.0,5273.1,5273.2,5273.3,5278.0,5280.0,5281.0,5282.0,5282.1,5282.2,5284.0,5287.0,5288.0,5290.0,5291.0,5292.0,5293.0,5294.0,5296.0,5297.0,5298.0,5299.0,5300.0,5301.0,5302.0,5304.0,5305.0,5305.1,5305.2,5305.3,5306.0,5310.0,5311.0,5313.0,5316.0,5319.0,5320.0,5323.0,5331.0,5333.0,5333.1,5334.0,5335.0,5336.0,5337.0,5338.0,5339.0,5340.0,5349.0,5359.0,5370.0,5371.0,5372.0,5423.0,5467.0,5509.0,5510.0,5578.0,5579.0,5579.1,5583.0,5584.0,5589.0,5591.0,5595.0,5608.0,5633.0,5637.0,5652.0,5653.0,5654.0,5666.0,5668.0,5738.0,5738.1,5738.2,5738.3,5738.4,5753.0,5772.0,5773.0,5778.0,5828.0,5851.0,5860.0,5860.1,6068.0,6188.0,6271.0,6513.0,6528.0</sig_subsig_ids>
    </category>
    <category  name="Code Execution"  cli_name="code_execution">
      <sigids>2156,3100,3101,3102,3107,3108,3114,3115,3118,3119,3124,3128,3129,3130,3131,3132,3133,3134,3135,3136,3137,3138,3139,3140,3141,3142,3143,3144,3145,3146,3150,3155,3156,3158,3159,3160,3161,3163,3165,3168,3169,3170,3172,3173,3177,3180,3200,3202,3203,3204,3205,3206,3207,3208,3209,3215,3218,3219,3223,3224,3226,3229,3230,3233,3234,3235,3252,3314,3317,3318,3319,3324,3327,3328,3329,3330,3331,3332,3333,3334,3336,3337,3338,3342,3353,3402,3403,3404,3405,3406,3407,3408,3452,3455,3457,3458,3459,3500,3501,3525,3526,3527,3528,3529,3534,3537,3540,3550,3575,3576,3577,3578,3650,3651,3652,3654,3700,3701,3703,3705,3706,3707,3708,3709,3714,3716,3718,3719,3728,3729,3731,3733,3734,3735,3737,3738,3739,3740,3783,3784,3785,3786,3788,3793,3802,3884,4056,4509,4510,4606,4613,4614,4615,4617,4701,4702,4703,4704,5035,5040,5041,5042,5047,5048,5050,5055,5057,5058,5059,5061,5062,5064,5065,5066,5068,5069,5071,5072,5073,5074,5078,5081,5084,5088,5090,5101,5105,5106,5112,5113,5116,5117,5118,5120,5121,5123,5126,5128,5129,5132,5138,5150,5152,5156,5158,5159,5161,5162,5167,5171,5173,5175,5182,5183,5191,5197,5199,5204,5208,5213,5215,5218,5220,5223,5224,5232,5233,5235,5238,5239,5240,5241,5243,5244,5245,5246,5247,5248,5255,5257,5268,5274,5275,5276,5277,5279,5283,5285,5286,5289,5303,5308,5309,5312,5314,5317,5318,5321,5322,5326,5330,5332,5343,5344,5347,5351,5352,5354,5360,5362,5363,5364,5365,5366,5375,5376,5377,5379,5383,5388,5391,5392,5393,5394,5397,5399,5405,5406,5407,5409,5410,5412,5413,5414,5416,5424,5425,5426,5429,5431,5433,5434,5435,5436,5437,5439,5441,5442,5443,5444,5446,5452,5454,5455,5456,5461,5463,5464,5465,5466,5468,5469,5471,5475,5476,5477,5478,5479,5480,5481,5483,5484,5485,5486,5487,5488,5489,5490,5491,5495,5496,5504,5507,5515,5517,5525,5528,5547,5548,5549,5552,5554,5556,5557,5559,5560,5561,5562,5564,5565,5569,5572,5573,5586,5588,5593,5594,5596,5597,5598,5600,5601,5609,5611,5635,5636,5642,5643,5644,5646,5647,5649,5659,5660,5661,5662,5663,5665,5667,5669,5672,5673,5674,5677,5681,5683,5684,5686,5688,5692,5693,5694,5696,5699,5708,5713,5714,5717,5718,5725,5729,5730,5734,5735,5736,5737,5740,5746,5747,5749,5751,5752,5758,5760,5761,5763,5764,5765,5766,5767,5770,5774,5776,5777,5792,5793,5794,5795,5799,5801,5802,5810,5813,5814,5815,5817,5818,5819,5820,5821,5822,5823,5824,5826,5830,5831,5832,5833,5839,5840,5842,5843,5845,5848,5849,5850,5852,5855,5856,5857,5858,5862,5863,5865,5866,5869,5870,5871,5873,5874,5876,5878,5879,5880,5884,5885,5887,5888,5889,5890,5892,5898,5899,5902,5906,5908,5910,5915,5918,5920,5921,5928,5985,6007,6012,6013,6017,6030,6055,6056,6057,6059,6060,6069,6130,6131,6171,6186,6189,6190,6191,6192,6193,6194,6195,6196,6197,6198,6199,6200,6201,6202,6210,6211,6224,6228,6229,6232,6234,6235,6236,6242,6246,6258,6260,6262,6264,6265,6266,6267,6268,6269,6270,6272,6273,6274,6276,6278,6298,6299,6350,6403,6406,6408,6409,6410,6449,6509,6510,6512,6517,6518,6524,6526,6527,6530,6532,6533,6534,6535,6536,6541,6543,6544,6545,6760,6761,6767,6768,6769,6771,6773,6775,6776,6777,6778,6780,6781,6782,6784,6785,6786,6787,6788,6793,6794,6798,6921,6922,6923,6924,6925,6928,6929,6930,6931,6934,6935,6936,6937,6939,6940,6942,6944,6945,6946,6951,6952,6954,6959,6960,6961,6963,6964,6966,6967,6968,6969,6973,12025,12026,12687</sigids>
      <sig_subsig_ids>2156.0,3100.0,3101.0,3102.0,3107.0,3108.0,3114.0,3115.0,3118.0,3119.0,3124.0,3128.0,3128.1,3129.0,3130.0,3131.0,3132.0,3132.1,3133.0,3133.1,3134.0,3135.0,3135.1,3135.2,3135.3,3135.4,3135.5,3135.6,3135.7,3136.0,3136.1,3136.5,3136.6,3136.7,3136.8,3136.9,3136.10,3136.11,3137.0,3137.1,3137.2,3137.3,3137.4,3137.6,3138.0,3139.0,3140.0,3140.1,3140.2,3140.3,3140.4,3140.5,3140.6,3140.7,3140.8,3140.9,3140.10,3140.11,3140.12,3140.13,3140.14,3140.15,3140.16,3140.17,3140.18,3140.19,3141.0,3142.0,3142.1,3142.3,3143.0,3143.1,3143.2,3143.3,3143.4,3144.0,3145.0,3145.1,3146.0,3150.0,3155.0,3156.0,3158.0,3159.0,3160.0,3161.0,3161.1,3163.0,3165.0,3168.0,3169.0,3170.0,3172.0,3173.0,3177.0,3180.0,3180.1,3200.0,3202.0,3203.0,3204.0,3205.0,3206.0,3207.0,3208.0,3209.0,3215.0,3218.0,3219.0,3223.0,3224.0,3226.0,3229.0,3230.0,3233.0,3234.0,3234.1,3235.0,3235.1,3252.0,3314.0,3314.1,3314.2,3317.0,3318.0,3319.0,3324.0,3327.0,3327.1,3327.2,3327.3,3327.4,3327.5,3327.6,3327.8,3327.9,3327.10,3327.11,3327.12,3328.0,3328.1,3328.2,3328.3,3329.0,3330.0,3331.0,3331.1,3331.2,3331.3,3331.4,3332.0,3333.0,3334.0,3334.1,3334.2,3334.3,3334.4,3334.5,3334.6,3334.7,3334.8,3336.0,3337.0,3338.0,3338.1,3338.2,3338.3,3342.0,3342.1,3353.0,3353.1,3353.2,3402.0,3402.1,3402.2,3402.3,3402.4,3403.0,3404.0,3405.0,3406.0,3407.0,3408.0,3452.0,3455.0,3457.0,3458.0,3459.0,3459.1,3500.0,3501.0,3525.0,3526.0,3527.0,3527.3,3527.6,3528.0,3529.0,3534.0,3537.0,3540.0,3550.0,3575.0,3576.0,3577.0,3578.0,3650.0,3651.0,3652.0,3654.0,3700.0,3701.0,3703.0,3705.0,3706.0,3707.0,3708.0,3709.0,3714.0,3716.0,3716.1,3718.0,3719.0,3728.0,3729.0,3731.0,3733.0,3734.0,3735.0,3737.0,3738.0,3739.0,3740.0,3783.0,3784.0,3785.0,3786.0,3788.0,3793.0,3802.0,3884.0,4056.0,4509.0,4510.0,4606.0,4606.1,4613.0,4613.1,4614.0,4614.1,4615.1,4617.0,4617.1,4701.0,4702.0,4703.0,4704.0,5035.0,5040.1,5040.2,5040.3,5041.0,5042.1,5042.2,5042.3,5042.4,5042.5,5042.6,5047.0,5048.0,5050.0,5055.0,5057.0,5057.1,5058.0,5059.0,5059.1,5059.2,5061.0,5062.0,5064.0,5065.0,5066.0,5068.0,5069.0,5071.0,5072.0,5073.0,5074.0,5078.0,5081.0,5084.0,5084.1,5088.0,5090.0,5101.0,5105.0,5106.0,5112.0,5113.0,5116.0,5117.0,5118.0,5120.0,5121.0,5123.0,5123.1,5123.2,5126.0,5128.0,5129.0,5132.0,5138.0,5150.0,5152.0,5156.0,5158.0,5159.0,5161.0,5162.0,5167.0,5171.0,5173.0,5175.0,5182.0,5183.0,5191.0,5197.0,5199.0,5204.0,5204.1,5208.0,5213.0,5215.1,5218.0,5220.0,5223.0,5224.0,5232.1,5233.0,5235.0,5238.0,5239.0,5240.0,5241.0,5243.0,5243.1,5243.2,5243.3,5243.4,5243.5,5243.6,5244.0,5245.0,5246.0,5247.0,5248.0,5255.0,5257.0,5268.0,5274.0,5274.1,5275.0,5275.1,5276.0,5276.1,5276.2,5277.0,5279.0,5283.0,5285.0,5286.0,5289.0,5303.0,5308.0,5309.0,5312.0,5314.0,5317.0,5318.0,5321.0,5322.0,5322.1,5326.0,5330.0,5332.0,5343.0,5344.0,5347.0,5351.0,5352.0,5354.0,5360.0,5362.0,5363.0,5364.0,5365.0,5366.0,5366.1,5375.0,5376.0,5377.0,5379.0,5383.0,5383.1,5383.2,5388.0,5388.1,5388.2,5388.3,5391.0,5392.0,5393.0,5394.0,5397.0,5399.0,5405.0,5406.0,5406.1,5407.0,5409.0,5409.1,5410.0,5412.0,5413.0,5414.0,5416.0,5416.1,5424.0,5425.0,5426.0,5429.0,5429.1,5431.0,5431.1,5433.0,5434.0,5434.1,5435.0,5436.0,5436.1,5437.0,5439.0,5441.0,5441.1,5442.0,5443.0,5444.0,5446.0,5452.0,5454.0,5455.0,5455.1,5456.0,5461.0,5463.0,5463.1,5464.0,5465.0,5466.0,5468.0,5469.0,5471.0,5471.1,5475.0,5476.0,5477.0,5477.1,5477.2,5478.0,5478.1,5479.0,5480.0,5481.0,5483.0,5484.0,5485.0,5485.1,5486.0,5486.1,5487.0,5488.0,5489.0,5489.1,5489.2,5489.3,5489.4,5489.5,5489.6,5489.7,5490.0,5491.0,5495.0,5496.0,5504.0,5507.0,5515.0,5517.0,5525.0,5528.0,5547.0,5548.0,5549.0,5552.0,5554.0,5556.0,5556.1,5556.3,5556.4,5557.0,5557.1,5557.2,5559.0,5560.0,5561.0,5561.2,5562.0,5564.0,5565.0,5565.1,5565.2,5565.3,5565.4,5569.0,5572.0,5572.1,5572.2,5573.0,5586.0,5588.1,5593.0,5594.0,5596.0,5597.0,5598.0,5598.1,5600.0,5601.0,5601.1,5609.0,5609.1,5609.2,5611.0,5635.0,5635.1,5635.2,5636.0,5642.0,5642.1,5642.3,5643.0,5644.0,5644.1,5644.2,5644.3,5646.0,5647.0,5649.0,5659.0,5660.0,5661.0,5662.0,5663.0,5665.0,5667.0,5669.0,5672.0,5673.0,5674.0,5677.0,5681.0,5683.0,5683.1,5683.2,5684.2,5684.4,5686.0,5688.0,5692.0,5693.0,5693.1,5694.0,5696.0,5696.1,5699.0,5708.0,5713.0,5714.0,5717.0,5718.0,5725.0,5729.1,5730.0,5734.0,5735.0,5736.0,5737.0,5740.0,5740.1,5746.0,5747.0,5749.0,5751.0,5752.0,5758.0,5760.0,5761.0,5763.0,5764.0,5765.0,5766.0,5767.0,5770.0,5774.0,5776.0,5776.4,5777.0,5792.0,5793.0,5794.0,5795.0,5799.0,5799.4,5799.7,5801.0,5801.1,5802.0,5810.0,5813.0,5813.1,5813.2,5813.3,5813.4,5814.0,5814.1,5814.2,5815.0,5815.1,5815.2,5817.0,5818.0,5818.1,5818.2,5818.3,5818.4,5818.5,5818.6,5818.7,5818.8,5818.9,5818.10,5818.11,5819.0,5820.0,5821.0,5821.1,5821.2,5822.0,5822.1,5822.2,5823.0,5824.0,5826.0,5830.0,5831.0,5832.0,5832.1,5832.2,5832.3,5833.0,5839.0,5840.0,5840.1,5840.2,5842.0,5843.0,5845.0,5848.0,5849.0,5850.0,5850.1,5852.0,5855.0,5856.0,5856.1,5856.2,5857.0,5857.1,5857.2,5858.0,5858.1,5858.2,5858.3,5858.4,5858.5,5862.0,5863.0,5863.1,5863.2,5865.0,5865.1,5865.2,5866.0,5869.0,5870.0,5871.0,5873.0,5874.0,5876.0,5878.0,5879.0,5880.0,5884.0,5884.1,5885.0,5887.0,5888.0,5889.0,5890.0,5892.0,5898.0,5899.0,5902.0,5906.0,5908.0,5908.1,5908.2,5910.0,5915.0,5918.0,5920.0,5921.0,5928.0,5985.0,6007.0,6012.0,6013.0,6013.1,6017.0,6017.3,6030.0,6055.0,6055.1,6055.2,6056.0,6056.1,6056.2,6057.0,6057.1,6057.2,6059.0,6059.1,6059.2,6060.0,6060.1,6060.2,6060.3,6069.0,6069.4,6069.6,6130.0,6130.2,6130.3,6130.4,6130.5,6130.6,6130.7,6130.8,6130.9,6130.10,6130.11,6131.0,6131.1,6131.2,6131.5,6131.7,6131.10,6131.11,6171.0,6186.0,6189.0,6189.1,6190.0,6190.1,6191.0,6191.1,6192.0,6192.1,6193.0,6193.1,6194.0,6194.1,6195.0,6195.1,6196.0,6196.1,6197.0,6197.1,6198.0,6198.1,6199.0,6199.1,6200.0,6201.0,6202.1,6202.2,6210.0,6211.0,6224.0,6228.0,6229.0,6232.0,6234.0,6235.0,6236.0,6242.0,6246.0,6258.0,6260.0,6262.0,6264.0,6265.0,6266.0,6267.0,6268.0,6269.0,6270.0,6272.0,6273.0,6274.0,6276.0,6276.1,6278.0,6298.0,6299.0,6350.0,6403.0,6406.0,6408.0,6409.0,6410.0,6449.0,6509.0,6510.0,6512.0,6517.0,6518.0,6524.0,6526.0,6527.0,6530.0,6532.0,6533.0,6534.0,6535.0,6536.0,6541.0,6543.0,6544.0,6544.1,6545.0,6760.0,6761.0,6767.0,6768.0,6769.0,6771.0,6773.0,6775.0,6775.1,6776.0,6777.0,6777.1,6777.2,6778.0,6780.0,6780.2,6781.0,6782.0,6784.0,6784.1,6784.2,6784.3,6785.0,6786.0,6787.0,6788.0,6788.3,6793.0,6793.1,6794.0,6798.0,6921.0,6922.0,6923.0,6924.0,6925.0,6928.0,6929.0,6930.0,6931.0,6934.0,6935.0,6936.1,6937.0,6939.0,6940.0,6942.0,6942.1,6944.0,6945.0,6946.0,6951.0,6952.0,6954.0,6954.1,6959.0,6960.0,6961.0,6963.0,6964.0,6966.0,6967.0,6968.0,6968.2,6969.0,6973.0,12025.0,12025.1,12026.0,12687.0</sig_subsig_ids>
    </category>
    <category  name="Policy Violation"  cli_name="policy_violation">
      <sigids>1250,1600,1601,1602,1603,1604,1605,1606,3127,3304,3409,3720,3721,5406,5432,5440,5462,5503,5526,5534,5535,5536,5537,5538,5539,5540,5577,5619,5632,5697,5701,5768,5771,5773,5806,6005,6537,7201,7202,7203,7205,11000,11001,11002,11003,11004,11005,11006,11007,11008,11009,11010,11011,11012,11013,11014,11015,11016,11017,11018,11019,11020,11021,11022,11023,11024,11025,11026,11027,11028,11029,11030,11031,11200,11201,11202,11203,11204,11205,11206,11207,11208,11209,11210,11211,11212,11213,11214,11215,11216,11217,11218,11219,11221,11222,11223,11224,11225,11226,11227,11228,11229,11230,11231,11232,11233,11234,11235,11236,11237,11238,11239,11240,11241,11242,11244,11245,11246,11247,11248,11249,11250,11251,11252,12000,12001,12002,12003,12004,12005,12006,12007,12008,12009,12010,12011,12012,12013,12014,12015,12016,12017,12018,12019,12020,12021,12022,12023,12024,12027,12500,12501,12502,12503,12505,12621,12622,12623,12624,12626,12627,12628,12629,12631,12633,12634,12635,12636,12637,12638,12639,12641,12642,12643,12644,12645,12646,12648,12649,12650,12651,12652,12653,12654,12655,12656,12658,12659,12660,12661,12662,12663,12664,12665,12666,12667,12668,12669,12674,12675,12676,12694,12713,12900</sigids>
      <sig_subsig_ids>1250.0,1600.0,1601.0,1602.0,1603.0,1604.0,1605.0,1606.0,3127.0,3304.0,3409.0,3409.1,3409.2,3409.3,3720.0,3721.0,5406.1,5432.0,5440.0,5462.0,5503.0,5526.0,5534.0,5534.1,5534.2,5535.0,5536.0,5537.0,5538.0,5539.0,5540.0,5577.0,5619.0,5619.1,5632.0,5632.1,5697.0,5701.0,5701.1,5768.0,5771.0,5773.1,5806.0,5806.1,5806.2,5806.3,5806.4,6005.0,6537.0,6537.1,7201.0,7202.0,7203.0,7205.0,11000.0,11000.1,11000.2,11000.3,11001.0,11001.1,11002.0,11002.1,11003.0,11003.1,11004.0,11004.1,11005.0,11005.1,11005.2,11006.0,11006.1,11007.0,11007.1,11008.0,11008.1,11009.0,11009.1,11010.0,11010.1,11011.0,11011.1,11012.0,11012.1,11013.0,11013.1,11014.0,11015.0,11016.0,11017.0,11017.1,11018.0,11018.1,11019.0,11019.1,11020.0,11020.1,11021.0,11022.0,11022.1,11023.0,11023.1,11024.0,11025.0,11026.0,11027.0,11027.1,11028.0,11029.0,11030.0,11031.0,11200.0,11201.0,11202.0,11203.0,11204.0,11205.0,11206.0,11207.0,11208.0,11209.0,11210.0,11210.1,11211.0,11211.1,11212.0,11213.0,11214.0,11215.0,11216.0,11217.0,11218.0,11219.0,11221.0,11222.0,11223.0,11224.0,11225.0,11226.0,11227.0,11228.0,11229.0,11230.0,11231.0,11232.0,11233.0,11233.1,11233.2,11233.3,11234.0,11235.0,11236.0,11237.0,11238.0,11239.0,11240.0,11241.0,11242.0,11244.0,11245.0,11245.1,11245.2,11245.3,11246.0,11247.0,11248.0,11249.0,11250.0,11251.0,11252.0,11252.1,12000.0,12001.0,12002.0,12002.1,12003.0,12004.0,12005.0,12005.1,12006.0,12007.0,12008.0,12009.0,12010.0,12011.0,12012.0,12013.0,12014.0,12014.1,12015.0,12015.1,12016.0,12017.0,12018.0,12019.0,12020.0,12021.0,12022.0,12022.1,12023.1,12024.0,12027.0,12500.1,12500.2,12500.3,12500.4,12500.5,12500.6,12500.7,12500.8,12500.9,12500.10,12501.0,12501.1,12501.2,12501.3,12501.4,12501.5,12501.6,12501.7,12501.8,12501.9,12501.10,12501.11,12501.12,12501.13,12501.14,12501.15,12501.16,12501.17,12501.18,12501.19,12501.20,12501.21,12501.22,12501.23,12501.24,12501.25,12501.26,12501.27,12501.28,12501.29,12501.30,12501.31,12501.32,12501.33,12501.34,12501.35,12501.36,12501.37,12501.38,12501.39,12501.40,12501.41,12501.42,12502.0,12502.1,12502.2,12502.3,12502.4,12502.6,12503.1,12503.2,12503.3,12503.4,12505.1,12505.2,12505.3,12505.4,12505.5,12505.6,12621.1,12621.2,12622.1,12622.2,12623.1,12623.2,12624.1,12624.2,12626.1,12626.2,12627.1,12627.2,12628.1,12628.2,12629.1,12631.1,12633.1,12633.2,12634.1,12634.2,12635.1,12635.2,12636.1,12636.2,12637.1,12637.2,12638.1,12638.2,12639.1,12639.2,12641.1,12641.2,12642.1,12643.1,12644.1,12645.1,12645.2,12646.1,12646.2,12648.1,12648.2,12649.1,12649.2,12650.1,12651.1,12651.2,12652.1,12652.2,12653.1,12654.1,12654.2,12655.1,12655.2,12656.1,12656.2,12658.1,12659.1,12660.1,12660.2,12661.1,12662.1,12663.1,12663.2,12664.1,12664.2,12665.1,12666.1,12667.1,12667.2,12668.1,12669.1,12674.0,12675.0,12676.0,12694.0,12713.0,12900.0</sig_subsig_ids>
    </category>
    <category  name="IDS Evasion"  cli_name="ids_evasion">
      <sigids>1201,1202,1203,1204,1205,1206,1207,1208,1300,1308,1330,3253</sigids>
      <sig_subsig_ids>1201.0,1202.0,1203.0,1204.0,1205.0,1206.0,1207.0,1208.0,1300.0,1308.0,1330.8,3253.0</sig_subsig_ids>
    </category>
  </category>
  <category name="Other Services" cli_name="other_services">
    <category  name="General Service"  cli_name="general_service">
      <sigids>1000,1001,1002,1003,1004,1005,1006,1007,1101,1102,1104,1107,1108,1109,1200,1201,1202,1203,1204,1205,1206,1207,1208,1220,1225,1250,1300,1301,1302,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1330,1600,1601,1602,1603,1604,1605,1606,1607,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2100,2101,2102,2150,2151,2152,2153,2154,2155,2157,2158,2200,2201,2202,3001,3002,3003,3005,3006,3010,3011,3012,3015,3016,3020,3021,3030,3031,3032,3033,3034,3035,3036,3037,3038,3039,3040,3041,3042,3043,3045,3046,3050,3051,3052,3111,3114,3116,3117,3118,3120,3123,3134,3135,3142,3143,3178,3180,3250,3251,3317,3318,3319,3327,3331,3334,3409,3451,3452,3453,3454,3455,3456,3457,3458,3459,3461,3462,3464,3465,3466,3525,3526,3527,3528,3529,3530,3534,3540,3550,3551,3577,3578,3602,3603,3604,3700,3701,3702,3703,3705,3706,3709,3710,3711,3714,3730,3731,3733,3734,3735,3736,3738,3740,3782,3783,3784,3789,3790,3793,3884,3990,3991,3992,4001,4002,4003,4050,4051,4052,4053,4054,4055,4058,4060,4061,4062,4063,4067,4150,4600,4601,4607,4608,4609,4610,4615,4617,5222,5339,5348,5406,5428,5429,5433,5434,5436,5438,5440,5447,5448,5449,5450,5454,5455,5463,5464,5465,5466,5467,5468,5469,5471,5475,5478,5479,5480,5485,5486,5488,5489,5492,5495,5497,5504,5505,5506,5507,5508,5511,5518,5529,5530,5532,5533,5534,5535,5536,5537,5538,5539,5540,5541,5543,5544,5546,5548,5549,5557,5560,5561,5562,5564,5565,5567,5568,5569,5612,5613,5614,5615,5616,5617,5618,5619,5620,5621,5622,5623,5624,5625,5626,5627,5628,5629,5630,5631,5632,5641,5644,5648,5649,5650,5651,5655,5656,5659,5660,5669,5671,5672,5673,5674,5677,5679,5681,5684,5686,5697,5698,5699,5710,5714,5716,5717,5718,5725,5726,5728,5732,5736,5739,5740,5743,5748,5751,5757,5758,5759,5760,5761,5764,5779,5780,5781,5782,5783,5784,5786,5787,5788,5816,5818,5820,5825,5826,5830,5831,5832,5837,5854,5855,5857,5858,5862,5864,5866,5890,5893,5902,5913,6009,6012,6013,6050,6051,6052,6053,6054,6055,6056,6057,6058,6059,6060,6061,6062,6063,6064,6065,6066,6067,6113,6120,6130,6131,6177,6178,6179,6181,6184,6186,6224,6260,6269,6300,6302,6303,6501,6502,6503,6504,6505,6506,6507,6508,6515,6517,6518,6520,6521,6523,6532,6533,6537,6764,6798,6799,6901,6902,6903,6910,6920,6931,6936,7101,7102,7104,7105,9000,9001,9002,9003,9004,9005,9006,9007,9008,9009,9010,9011,9012,9013,9014,9015,9016,9017,9018,9019,9020,9021,9022,9023,9024,9025,9026,9027,9028,9029,9030,9031,9032,9033,9036,9037,9038,9039,9040,9041,9042,9043,9044,9045,9200,9201,9202,9203,9204,9205,9206,9207,9208,9209,9210,9211,9212,9213,9214,9215,9216,9217,9218,9223,9224,9225,9226,9227,9228,9229,9230,9231,9232,9233,9236,9237,9238,9239,9240,9241,9242,9243,9244,9245,9400,9401,9402,9403,9404,9405,9406,9407,9408,9409,9410,9411,9412,9413,9414,9415,9416,9417,9418,9419,9420,9421,9422,9423,9424,9425,9426,9427,9428,9429,9430,9431,9432,9433,9434,9435,9436,9437,9438,9439,9440,9441,9442,9443,9444,9445,9446,9447,9449,9450,9451,9452,9453,9454,9455,9456,9457,9458,9459,9460,9461,9462,9463,9464,9465,9466,9467,9468,9469,9470,9471,9472,9473,9474,9475,9476,9477,9478,9479,9480,9481,9482,9483,9484,9485,9486,9487,9488,9489,9490,9491,9492,9493,9494,9495,9496,9497,9498,9499,9500,9501,9502,9503,9504,9505,9506,9507,9508,9509,9510,9511,9512,9513,9514,9515,9516,9517,9518,9519,9520,9521,9522,9523,9524,9525,9527,9528,9529,9530,9531,9532,9533,9534,9535,9536,9537,9538,9539,9540,9541,9542,9543,9544,9545,9546,9547,9548,9549,9550,9551,9552,9553,9554,9555,9556,9557,9558,9559,9560,9561,9562,9563,9564,9565,9566,9567,9568,9570,9571,9572,9573,9575,9576,9577,9578,9579,9580,9581,9582,9583,11021,11203,11204,11245,11251,11252,12674,12675,12921,13000,13001,13002,13003,13004,13005,13006,13007,13008,50000</sigids>
      <sig_subsig_ids>1000.0,1001.0,1002.0,1003.0,1004.0,1005.0,1006.0,1007.0,1101.0,1102.0,1104.0,1107.0,1108.0,1109.0,1200.0,1201.0,1202.0,1203.0,1204.0,1205.0,1206.0,1207.0,1208.0,1220.0,1225.0,1250.0,1300.0,1301.0,1302.0,1303.0,1304.0,1305.0,1306.0,1306.1,1306.2,1306.3,1306.4,1306.5,1307.0,1308.0,1309.0,1310.0,1311.0,1312.0,1313.0,1314.0,1315.0,1316.0,1330.0,1330.1,1330.2,1330.3,1330.4,1330.5,1330.6,1330.7,1330.8,1330.9,1330.10,1330.11,1330.12,1330.13,1330.14,1330.15,1330.16,1330.17,1330.18,1600.0,1601.0,1602.0,1603.0,1604.0,1605.0,1606.0,1607.0,2000.0,2001.0,2001.1,2002.0,2003.0,2004.0,2005.0,2006.0,2007.0,2008.0,2009.0,2010.0,2011.0,2012.0,2100.0,2101.0,2102.0,2150.0,2151.0,2152.0,2153.0,2154.0,2155.0,2157.0,2158.0,2200.0,2201.0,2202.0,3001.0,3002.0,3003.0,3005.0,3006.0,3010.0,3011.0,3012.0,3015.0,3016.0,3020.0,3021.0,3030.0,3031.0,3032.0,3033.0,3034.0,3035.0,3036.0,3037.0,3038.0,3039.0,3040.0,3041.0,3042.0,3043.0,3045.0,3046.0,3050.0,3051.0,3051.1,3052.0,3111.1,3114.0,3116.0,3117.1,3118.0,3120.1,3123.0,3134.0,3135.0,3135.7,3142.0,3143.2,3178.0,3180.0,3250.0,3251.0,3317.0,3318.0,3319.0,3327.1,3327.2,3327.7,3327.9,3327.10,3327.13,3331.1,3334.2,3334.7,3409.2,3451.0,3452.0,3453.0,3454.0,3455.0,3456.0,3456.1,3456.3,3457.0,3458.0,3459.0,3459.1,3461.0,3462.0,3464.0,3465.0,3466.0,3525.0,3526.0,3527.0,3527.1,3527.2,3527.3,3527.4,3527.6,3528.0,3529.0,3530.0,3534.0,3540.0,3550.0,3551.0,3577.0,3578.0,3602.0,3603.0,3604.0,3700.0,3701.0,3702.0,3703.0,3705.0,3706.0,3709.0,3710.0,3711.0,3714.0,3730.0,3731.0,3733.0,3734.0,3735.0,3736.0,3738.0,3740.0,3782.0,3783.0,3784.0,3789.0,3790.0,3793.0,3884.0,3990.1,3990.2,3991.0,3992.1,3992.2,3992.3,3992.4,3992.5,4001.0,4002.0,4003.0,4050.0,4051.1,4051.2,4051.3,4052.1,4052.2,4053.0,4054.0,4054.1,4055.1,4055.2,4058.0,4058.2,4060.0,4060.1,4061.0,4062.0,4063.0,4067.0,4150.0,4600.0,4601.0,4601.1,4601.2,4601.3,4607.0,4607.1,4607.2,4607.3,4607.4,4607.5,4607.6,4607.7,4607.8,4607.9,4608.0,4608.1,4608.2,4608.3,4608.4,4608.5,4609.0,4609.1,4610.0,4610.1,4615.1,4617.0,4617.1,5222.0,5339.0,5348.0,5406.1,5428.0,5428.1,5429.1,5433.0,5434.0,5434.1,5436.0,5436.1,5438.0,5440.0,5447.0,5448.0,5449.0,5450.0,5454.0,5455.0,5455.1,5463.0,5463.1,5464.0,5464.1,5464.2,5465.0,5466.0,5467.0,5468.0,5469.0,5469.1,5471.0,5471.1,5475.0,5478.0,5478.1,5479.0,5480.0,5485.0,5485.1,5486.0,5486.1,5488.0,5489.0,5489.1,5489.3,5489.4,5489.5,5489.6,5489.7,5492.0,5495.0,5497.0,5504.0,5505.0,5505.1,5506.0,5506.1,5507.0,5508.0,5511.0,5518.0,5529.0,5529.1,5529.2,5529.3,5530.0,5532.0,5533.0,5534.0,5534.1,5534.2,5535.0,5536.0,5537.0,5538.0,5539.0,5540.0,5541.0,5543.0,5544.0,5546.0,5548.0,5549.0,5557.0,5557.1,5560.0,5561.0,5561.1,5561.2,5562.0,5564.0,5565.0,5565.1,5565.3,5567.0,5568.0,5569.0,5612.0,5613.0,5614.0,5615.0,5616.0,5617.0,5618.0,5619.0,5619.1,5620.0,5621.0,5622.0,5623.0,5624.0,5625.0,5626.0,5627.0,5627.1,5628.0,5629.0,5630.0,5631.0,5632.0,5632.1,5641.0,5641.1,5641.2,5644.0,5644.1,5644.2,5648.1,5649.0,5650.0,5651.0,5651.1,5655.0,5656.0,5659.0,5660.0,5669.0,5671.0,5672.0,5673.0,5674.0,5677.0,5679.0,5681.0,5684.0,5684.2,5684.3,5686.0,5697.0,5698.0,5699.0,5710.0,5714.0,5716.0,5717.0,5718.0,5725.0,5726.0,5726.1,5728.0,5732.1,5732.2,5736.0,5739.0,5739.1,5740.0,5740.1,5743.0,5748.4,5748.5,5751.0,5757.0,5758.0,5759.0,5759.1,5759.3,5760.0,5761.0,5764.0,5779.0,5780.0,5781.0,5782.0,5783.0,5784.0,5786.0,5787.0,5788.0,5816.1,5818.0,5818.1,5818.2,5818.3,5818.4,5818.5,5818.7,5818.8,5818.9,5818.10,5818.11,5820.0,5825.0,5826.0,5830.0,5831.0,5832.0,5832.1,5832.2,5832.3,5837.0,5854.0,5854.1,5855.0,5857.0,5857.1,5857.2,5858.4,5862.0,5864.0,5866.0,5890.0,5893.0,5893.1,5893.2,5902.0,5913.0,5913.1,6009.0,6012.0,6013.0,6013.1,6050.0,6050.1,6051.0,6052.0,6052.1,6053.0,6053.1,6054.0,6054.1,6055.0,6055.1,6056.0,6056.1,6056.2,6057.0,6057.1,6057.2,6058.0,6058.1,6059.0,6059.1,6059.2,6060.0,6060.1,6060.2,6060.3,6061.0,6061.1,6062.0,6062.1,6063.0,6063.1,6064.0,6065.0,6066.0,6067.0,6113.0,6120.0,6130.1,6130.2,6130.3,6130.4,6130.5,6130.6,6130.7,6130.8,6130.9,6130.10,6130.11,6131.1,6177.0,6178.0,6179.0,6181.0,6184.0,6186.0,6224.0,6260.0,6269.0,6300.0,6302.0,6303.0,6501.0,6502.0,6503.0,6504.0,6505.0,6505.1,6506.0,6506.1,6507.0,6508.0,6508.1,6508.2,6515.0,6517.0,6518.0,6518.1,6520.0,6521.0,6523.0,6532.0,6533.0,6537.0,6537.1,6764.0,6764.1,6798.0,6799.0,6901.0,6902.0,6903.0,6910.0,6920.0,6931.0,6936.0,7101.0,7102.0,7104.0,7105.0,9000.0,9001.0,9002.0,9003.0,9004.0,9005.0,9006.0,9007.0,9008.0,9009.0,9010.0,9011.0,9012.0,9013.0,9014.0,9015.0,9016.0,9017.0,9018.0,9019.0,9020.0,9021.0,9022.0,9023.0,9024.0,9025.0,9026.0,9027.0,9028.0,9029.0,9030.0,9031.0,9032.0,9033.0,9036.0,9037.0,9038.0,9039.0,9040.0,9041.0,9042.0,9043.0,9044.0,9045.0,9200.0,9201.0,9202.0,9203.0,9204.0,9205.0,9206.0,9207.0,9208.0,9209.0,9210.0,9211.0,9212.0,9213.0,9214.0,9215.0,9216.0,9217.0,9218.0,9223.0,9224.0,9225.0,9226.0,9227.0,9228.0,9229.0,9230.0,9231.0,9232.0,9233.0,9236.0,9237.0,9238.0,9239.0,9240.0,9241.0,9242.0,9243.0,9244.0,9245.0,9400.0,9400.1,9401.0,9401.1,9401.2,9402.0,9403.0,9403.1,9403.2,9404.0,9404.1,9405.0,9406.0,9407.0,9408.0,9409.0,9410.0,9411.0,9411.1,9411.2,9412.0,9412.1,9413.0,9414.0,9415.0,9416.0,9417.0,9418.0,9418.1,9419.0,9419.1,9420.0,9421.0,9422.0,9423.0,9423.1,9424.0,9425.0,9426.0,9427.0,9428.0,9429.0,9430.0,9430.1,9431.0,9432.0,9433.0,9433.1,9434.0,9435.0,9436.0,9437.0,9438.0,9439.0,9440.0,9441.0,9442.0,9443.0,9444.0,9445.0,9445.1,9445.2,9446.0,9447.0,9449.0,9450.0,9451.0,9452.0,9453.0,9454.0,9455.0,9456.0,9457.0,9458.0,9459.0,9460.0,9461.0,9462.0,9463.0,9464.0,9465.0,9466.0,9467.0,9468.0,9469.0,9470.0,9471.0,9472.0,9473.0,9473.1,9474.0,9475.0,9476.0,9477.0,9478.0,9479.0,9480.0,9481.0,9482.0,9483.0,9484.0,9485.0,9486.0,9487.0,9488.0,9488.1,9489.0,9490.0,9491.0,9492.0,9493.0,9494.0,9495.0,9496.0,9497.0,9498.0,9499.0,9500.0,9501.0,9502.0,9503.0,9504.0,9505.0,9506.0,9507.0,9508.0,9509.0,9510.0,9510.1,9511.0,9512.0,9513.0,9514.0,9515.0,9516.0,9517.0,9518.0,9519.0,9519.1,9519.2,9520.0,9521.0,9522.0,9523.0,9524.0,9525.0,9527.0,9528.0,9529.0,9530.0,9531.0,9532.0,9533.0,9534.0,9535.0,9536.0,9537.0,9538.0,9539.0,9540.0,9541.0,9542.0,9542.1,9543.0,9544.0,9545.0,9546.0,9546.1,9546.2,9547.0,9548.0,9549.0,9550.0,9551.0,9552.0,9553.0,9554.0,9555.0,9556.0,9557.0,9558.0,9559.0,9560.0,9560.1,9560.2,9561.0,9562.0,9562.1,9563.0,9563.1,9564.0,9565.0,9566.0,9567.0,9567.1,9568.0,9570.0,9571.0,9572.0,9573.0,9575.0,9576.0,9577.0,9578.0,9579.0,9580.0,9581.0,9582.0,9583.0,11021.0,11203.0,11204.0,11245.0,11245.1,11245.2,11245.3,11251.0,11252.0,11252.1,12674.0,12675.0,12921.0,13000.0,13000.1,13001.0,13001.1,13002.1,13003.0,13003.1,13004.0,13004.1,13005.0,13005.1,13006.0,13006.1,13007.0,13007.1,13008.0,13008.1,50000.0,50000.1,50000.2</sig_subsig_ids>
    </category>
    <category  name="SQL"  cli_name="sql">
      <sigids>3720,3721,3732,4701,4702,4703,4704,5444,5482,5689,6350,6792</sigids>
      <sig_subsig_ids>3720.0,3721.0,3732.0,4701.0,4702.0,4703.0,4704.0,5444.0,5482.0,5689.0,6350.0,6792.0</sig_subsig_ids>
    </category>
    <category  name="FTP"  cli_name="ftp">
      <sigids>3119,3150,3151,3152,3153,3154,3155,3156,3157,3158,3159,3160,3161,3162,3163,3164,3165,3166,3167,3168,3169,3170,3171,3172,3173,3175,3177,3179,3704,3785,3786,5457,5516,5559,5637,5652,5654,5668,5745,5746,5804,5805,5819,5839,5846,5847,5860,6068,6250,6973,12900,12901,12902,12903,12904,12905,12906,12907,12908,12909,12910,12911,12912,12913,12914,12915,12916,12917,12918,12919,12920,12922,12923,12924,12925,12926,12927,12928,12929,12930,12931,12932,12933</sigids>
      <sig_subsig_ids>3119.0,3150.0,3150.1,3151.0,3152.0,3153.0,3154.0,3155.0,3156.0,3157.0,3158.0,3159.0,3160.0,3161.0,3161.1,3162.0,3163.0,3164.0,3165.0,3166.0,3167.0,3168.0,3169.0,3170.0,3171.0,3171.1,3172.0,3173.0,3175.0,3177.0,3179.0,3704.0,3785.0,3786.0,5457.0,5516.0,5559.0,5637.0,5652.0,5654.0,5668.0,5745.0,5746.0,5804.0,5804.1,5805.0,5805.1,5819.0,5839.0,5846.0,5847.0,5847.1,5860.0,5860.1,6068.0,6250.0,6973.0,12900.0,12901.0,12902.0,12903.0,12904.0,12905.0,12906.0,12907.0,12908.0,12909.0,12910.0,12911.0,12912.0,12913.0,12914.0,12915.0,12916.0,12917.0,12918.0,12919.0,12920.0,12922.0,12923.0,12924.0,12925.0,12926.0,12927.0,12928.0,12929.0,12930.0,12931.0,12932.0,12933.0</sig_subsig_ids>
    </category>
    <category  name="HTTP"  cli_name="http">
      <sigids>3143,3200,3201,3202,3203,3204,3205,3206,3207,3208,3209,3210,3211,3212,3213,3214,3215,3216,3217,3218,3219,3220,3221,3222,3223,3224,3225,3226,3227,3228,3229,3230,3231,3232,3233,3234,3235,3236,3252,3253,3254,3255,3340,3347,3409,3537,3716,3718,3737,3739,3802,3883,4004,4151,5034,5035,5036,5037,5038,5039,5040,5041,5042,5043,5044,5045,5046,5047,5048,5049,5050,5051,5052,5053,5054,5055,5056,5057,5058,5059,5060,5061,5062,5063,5064,5065,5066,5067,5068,5069,5070,5071,5072,5073,5074,5075,5076,5077,5078,5079,5080,5081,5083,5084,5085,5086,5087,5088,5089,5090,5091,5092,5093,5095,5096,5097,5099,5100,5101,5102,5103,5104,5105,5106,5107,5108,5109,5110,5111,5112,5113,5114,5115,5116,5117,5118,5119,5120,5121,5122,5123,5124,5125,5126,5127,5128,5129,5130,5131,5132,5133,5134,5138,5140,5141,5142,5146,5147,5148,5149,5150,5151,5152,5154,5155,5156,5157,5158,5159,5160,5161,5162,5163,5164,5165,5166,5167,5168,5169,5170,5171,5172,5173,5174,5175,5176,5178,5179,5180,5181,5182,5183,5184,5188,5191,5194,5195,5196,5197,5199,5200,5201,5202,5203,5204,5205,5206,5207,5208,5209,5210,5211,5212,5213,5214,5215,5216,5217,5218,5219,5220,5221,5223,5224,5229,5230,5231,5232,5233,5234,5235,5236,5237,5238,5239,5240,5241,5243,5244,5245,5246,5247,5248,5251,5252,5253,5255,5256,5257,5258,5259,5260,5261,5262,5263,5265,5266,5268,5269,5270,5271,5272,5273,5274,5275,5276,5277,5278,5279,5280,5281,5282,5283,5284,5285,5286,5287,5288,5289,5290,5291,5292,5293,5294,5295,5296,5297,5298,5299,5300,5301,5302,5303,5304,5305,5306,5307,5308,5309,5310,5311,5312,5313,5314,5315,5316,5317,5318,5319,5320,5321,5322,5323,5324,5325,5326,5327,5328,5331,5332,5333,5334,5335,5336,5337,5338,5340,5341,5342,5343,5344,5345,5346,5347,5349,5350,5351,5352,5353,5354,5355,5356,5357,5358,5359,5360,5362,5363,5364,5365,5366,5367,5368,5369,5370,5371,5372,5373,5374,5375,5376,5377,5378,5379,5380,5381,5382,5383,5385,5386,5388,5389,5390,5391,5392,5393,5394,5395,5397,5399,5400,5401,5402,5405,5408,5409,5410,5411,5412,5413,5416,5417,5418,5419,5420,5421,5422,5423,5424,5425,5427,5431,5432,5435,5437,5439,5441,5442,5443,5444,5445,5446,5451,5452,5453,5456,5458,5459,5460,5461,5462,5472,5473,5474,5476,5477,5481,5483,5484,5490,5491,5494,5498,5499,5500,5501,5503,5515,5517,5519,5521,5523,5524,5527,5528,5531,5545,5551,5552,5554,5556,5557,5558,5566,5572,5573,5574,5608,5609,5610,5611,5633,5634,5636,5638,5642,5643,5645,5646,5647,5648,5657,5658,5661,5662,5664,5665,5666,5667,5676,5678,5680,5683,5684,5685,5687,5688,5692,5693,5694,5695,5696,5700,5701,5703,5705,5706,5711,5713,5715,5720,5722,5723,5724,5727,5729,5730,5731,5733,5734,5735,5737,5747,5749,5750,5752,5753,5754,5756,5763,5765,5769,5770,5771,5772,5773,5774,5775,5777,5778,5789,5790,5792,5796,5798,5800,5801,5802,5803,5807,5813,5814,5815,5816,5817,5821,5823,5824,5827,5828,5829,5833,5840,5845,5848,5849,5851,5852,5853,5856,5858,5861,5863,5865,5868,5869,5870,5871,5873,5874,5876,5877,5878,5879,5880,5885,5887,5888,5889,5892,5894,5898,5899,5903,5905,5906,5909,5910,5915,5916,5918,5919,5920,5921,5928,5930,5931,5985,6004,6007,6008,6011,6017,6069,6171,6187,6228,6229,6234,6235,6246,6249,6256,6257,6258,6261,6262,6263,6264,6265,6266,6267,6270,6271,6272,6273,6278,6298,6299,6403,6406,6408,6409,6410,6449,6500,6509,6510,6512,6513,6518,6522,6524,6526,6527,6528,6530,6534,6535,6536,6539,6540,6541,6543,6544,6545,6760,6765,6771,6773,6775,6776,6777,6778,6780,6784,6785,6786,6787,6788,6790,6793,6794,6922,6923,6924,6925,6928,6929,6930,6934,6935,6936,6937,6939,6940,6942,6944,6945,6951,6952,6954,6959,6960,6961,6963,6964,6966,6968,6969,7203,9574,11019,12000,12001,12002,12003,12004,12005,12006,12007,12008,12009,12010,12011,12012,12013,12014,12015,12016,12017,12018,12019,12020,12021,12023,12024,12025,12026,12027,12621,12622,12623,12624,12626,12627,12628,12629,12631,12633,12634,12635,12636,12637,12638,12639,12641,12642,12643,12644,12645,12646,12648,12649,12650,12651,12652,12653,12654,12655,12656,12658,12659,12660,12661,12662,12663,12664,12665,12666,12667,12668,12669,12673,12676,12677,12679,12680,12681,12682,12683,12685,12686,12687,12688,12689,12690,12693,12694,12695,12696,12697,12698,12699,12700,12701,12702,12703,12704,12705,12706,12707,12708,12709,12710,12711,12712,12713</sigids>
      <sig_subsig_ids>3143.0,3200.0,3201.1,3201.2,3201.3,3201.4,3201.5,3201.6,3202.0,3203.0,3204.0,3205.0,3206.0,3207.0,3208.0,3209.0,3210.0,3210.1,3210.2,3210.3,3211.0,3211.1,3211.2,3211.3,3212.0,3213.0,3214.0,3215.0,3216.0,3217.0,3218.0,3219.0,3220.0,3221.0,3222.0,3223.0,3224.0,3225.0,3226.0,3227.0,3228.0,3229.0,3230.0,3231.0,3232.0,3233.0,3234.0,3234.1,3235.0,3235.1,3236.0,3252.0,3253.0,3254.0,3254.1,3255.0,3340.0,3347.0,3347.2,3409.0,3409.3,3537.0,3716.0,3716.1,3718.0,3737.0,3739.0,3802.0,3883.0,4004.0,4151.1,5034.0,5035.0,5036.1,5036.2,5037.0,5038.0,5039.0,5040.1,5040.2,5040.3,5041.0,5042.1,5042.2,5042.3,5042.4,5042.5,5042.6,5043.1,5043.2,5043.3,5044.0,5045.0,5046.0,5047.0,5048.0,5049.0,5050.0,5051.0,5051.1,5051.2,5052.0,5053.0,5054.0,5055.0,5056.0,5057.0,5057.1,5058.0,5059.0,5059.1,5059.2,5060.0,5061.0,5062.0,5063.0,5064.0,5065.0,5066.0,5067.0,5068.0,5069.0,5070.0,5071.0,5072.0,5073.0,5074.0,5075.0,5076.0,5077.0,5078.0,5079.0,5080.0,5081.0,5083.0,5084.0,5084.1,5085.0,5086.0,5087.0,5087.1,5088.0,5089.0,5090.0,5091.0,5091.1,5092.0,5093.0,5095.0,5096.0,5097.0,5097.1,5097.2,5099.0,5100.0,5101.0,5102.0,5103.0,5104.0,5105.0,5106.0,5107.0,5108.0,5108.1,5108.2,5109.0,5109.1,5110.0,5111.0,5112.0,5113.0,5114.0,5114.1,5114.2,5114.3,5114.4,5114.5,5114.6,5114.7,5114.8,5115.0,5115.1,5115.2,5115.3,5115.4,5115.5,5115.6,5116.0,5117.0,5118.0,5119.0,5120.0,5121.0,5122.0,5123.0,5123.1,5123.2,5124.0,5124.1,5124.2,5125.0,5126.0,5127.0,5128.0,5129.0,5130.0,5131.0,5132.0,5133.0,5134.0,5138.0,5140.0,5141.0,5142.0,5142.1,5146.0,5146.1,5146.2,5146.3,5146.4,5146.5,5146.6,5146.7,5146.8,5146.9,5146.10,5146.11,5146.12,5146.13,5146.14,5146.15,5146.16,5146.17,5147.0,5148.0,5149.0,5150.0,5151.0,5152.0,5154.0,5155.0,5156.0,5157.0,5158.0,5159.0,5160.0,5161.0,5162.0,5163.0,5164.0,5165.0,5166.0,5167.0,5168.0,5169.0,5170.0,5170.1,5171.0,5172.0,5173.0,5174.0,5175.0,5176.0,5178.0,5179.0,5180.0,5181.0,5181.1,5182.0,5183.0,5184.0,5188.0,5188.1,5188.2,5188.3,5191.0,5194.0,5194.1,5194.2,5195.0,5196.0,5196.1,5197.0,5199.0,5200.0,5201.0,5201.1,5201.2,5202.0,5202.1,5203.0,5204.0,5204.1,5205.0,5206.0,5207.0,5207.1,5208.0,5209.0,5210.0,5210.1,5211.0,5212.0,5213.0,5214.0,5215.0,5215.1,5216.0,5216.1,5217.0,5218.0,5219.0,5220.0,5221.0,5221.1,5221.2,5221.3,5221.4,5223.0,5224.0,5229.0,5230.0,5231.0,5232.0,5232.1,5233.0,5234.0,5234.1,5235.0,5236.0,5237.0,5238.0,5239.0,5240.0,5241.0,5243.0,5243.1,5243.2,5243.3,5243.4,5243.5,5243.6,5244.0,5245.0,5246.0,5247.0,5248.0,5251.0,5252.0,5253.0,5255.0,5256.0,5257.0,5258.0,5259.0,5260.0,5261.0,5262.0,5263.0,5265.0,5266.0,5268.0,5269.0,5270.0,5271.0,5272.0,5273.0,5273.1,5273.2,5273.3,5274.0,5274.1,5275.0,5275.1,5276.0,5276.1,5276.2,5277.0,5278.0,5279.0,5280.0,5281.0,5282.0,5282.1,5282.2,5283.0,5284.0,5285.0,5286.0,5287.0,5288.0,5289.0,5290.0,5291.0,5292.0,5293.0,5294.0,5295.0,5296.0,5297.0,5298.0,5299.0,5300.0,5301.0,5302.0,5303.0,5304.0,5305.0,5305.1,5305.2,5305.3,5306.0,5307.0,5308.0,5309.0,5310.0,5311.0,5312.0,5313.0,5314.0,5315.0,5316.0,5317.0,5318.0,5319.0,5320.0,5321.0,5322.0,5322.1,5323.0,5324.0,5325.0,5326.0,5327.0,5328.0,5328.1,5331.0,5332.0,5333.0,5333.1,5334.0,5335.0,5336.0,5337.0,5338.0,5340.0,5341.0,5342.0,5343.0,5344.0,5345.0,5346.0,5347.0,5349.0,5350.0,5351.0,5352.0,5353.0,5354.0,5355.0,5356.0,5357.0,5358.0,5359.0,5360.0,5362.0,5363.0,5364.0,5365.0,5366.0,5366.1,5367.0,5368.0,5369.0,5370.0,5371.0,5372.0,5373.0,5374.0,5374.1,5374.2,5375.0,5376.0,5377.0,5378.0,5379.0,5380.0,5381.0,5382.0,5383.0,5383.1,5383.2,5385.0,5386.0,5388.0,5388.1,5388.2,5388.3,5389.0,5390.0,5391.0,5392.0,5393.0,5394.0,5395.0,5397.0,5399.0,5400.0,5401.0,5402.0,5405.0,5408.0,5408.1,5409.0,5409.1,5410.0,5411.0,5412.0,5413.0,5416.0,5416.1,5417.0,5418.0,5419.0,5420.0,5421.0,5422.0,5423.0,5424.0,5425.0,5427.0,5431.0,5431.1,5432.0,5435.0,5437.0,5439.0,5441.0,5441.1,5442.0,5443.0,5444.0,5445.0,5446.0,5451.0,5452.0,5453.0,5453.1,5456.0,5458.0,5459.0,5459.1,5460.0,5461.0,5462.0,5472.0,5473.0,5474.0,5476.0,5477.0,5477.1,5477.2,5481.0,5483.0,5484.0,5490.0,5491.0,5494.0,5498.0,5499.0,5500.0,5501.0,5503.0,5515.0,5517.0,5519.0,5521.0,5523.0,5524.0,5527.0,5528.0,5531.0,5545.0,5545.1,5551.0,5552.0,5554.0,5556.0,5556.1,5556.2,5556.3,5556.4,5557.0,5557.1,5557.2,5558.0,5566.0,5572.0,5572.1,5572.2,5573.0,5574.0,5608.0,5609.0,5609.1,5609.2,5610.0,5611.0,5633.0,5634.0,5636.0,5638.0,5642.0,5642.1,5642.2,5642.3,5643.0,5645.0,5646.0,5647.0,5648.0,5657.0,5658.0,5661.0,5662.0,5664.0,5665.0,5666.0,5667.0,5676.0,5678.0,5680.0,5683.0,5683.1,5683.2,5684.1,5684.4,5684.5,5684.6,5685.0,5687.0,5688.0,5692.0,5693.0,5693.1,5694.0,5695.0,5696.0,5696.1,5700.0,5701.0,5701.1,5703.0,5705.0,5706.0,5711.0,5713.0,5715.0,5720.0,5722.0,5723.0,5724.0,5727.0,5729.1,5730.0,5731.1,5731.2,5733.0,5734.0,5735.0,5737.0,5747.0,5747.1,5747.2,5749.0,5750.0,5752.0,5753.0,5754.0,5756.0,5763.0,5765.0,5769.0,5769.1,5770.0,5771.0,5772.0,5773.0,5773.1,5774.0,5775.0,5775.1,5777.0,5778.0,5789.0,5790.0,5792.0,5796.0,5798.0,5800.0,5801.0,5802.0,5803.0,5807.0,5813.0,5813.1,5813.3,5813.4,5814.0,5814.1,5814.2,5815.0,5815.1,5815.2,5816.0,5817.0,5821.0,5821.1,5821.2,5823.0,5824.0,5827.0,5827.1,5827.2,5828.0,5829.0,5833.0,5840.0,5840.1,5840.2,5845.0,5848.0,5849.0,5851.0,5852.0,5853.0,5856.0,5856.1,5856.2,5858.5,5861.0,5863.0,5863.1,5863.2,5865.0,5865.1,5865.2,5868.0,5869.0,5870.0,5871.0,5873.0,5874.0,5876.0,5877.0,5878.0,5879.0,5880.0,5885.0,5887.0,5888.0,5889.0,5892.0,5894.0,5894.1,5898.0,5899.0,5903.0,5903.1,5903.2,5905.0,5905.1,5906.0,5909.0,5910.0,5915.0,5916.0,5918.0,5918.1,5919.0,5920.0,5921.0,5928.0,5930.0,5930.1,5930.2,5930.3,5930.4,5930.5,5931.0,5931.1,5985.0,6004.0,6007.0,6008.0,6011.0,6017.0,6017.1,6017.2,6017.3,6017.4,6017.5,6069.0,6069.1,6069.2,6069.3,6069.4,6069.5,6069.6,6069.7,6069.8,6171.0,6187.0,6228.0,6228.1,6228.2,6228.3,6229.0,6229.1,6229.2,6234.0,6235.0,6246.0,6246.1,6249.0,6256.0,6257.0,6258.0,6261.0,6262.0,6263.0,6264.0,6265.0,6266.0,6267.0,6270.0,6271.0,6272.0,6273.0,6278.0,6278.1,6278.2,6298.0,6298.1,6299.0,6403.0,6403.1,6406.0,6408.0,6408.1,6409.0,6409.1,6409.2,6410.0,6410.1,6410.2,6449.0,6500.0,6500.1,6509.0,6509.1,6509.2,6510.0,6510.1,6510.2,6512.0,6512.1,6512.2,6513.0,6513.1,6513.2,6518.1,6522.0,6524.0,6524.1,6526.0,6527.0,6528.0,6530.0,6534.0,6534.1,6535.0,6535.1,6536.0,6536.1,6539.0,6539.1,6540.0,6541.0,6543.0,6544.0,6544.1,6545.0,6760.0,6760.1,6760.2,6765.0,6771.0,6773.0,6775.0,6775.1,6776.0,6777.0,6777.1,6777.2,6778.0,6780.0,6780.1,6780.2,6784.0,6784.1,6784.2,6784.3,6785.0,6785.1,6785.2,6786.0,6787.0,6788.0,6788.1,6788.2,6788.3,6788.4,6790.0,6790.1,6793.0,6793.1,6794.0,6794.1,6922.0,6923.0,6923.1,6924.0,6925.0,6925.1,6925.2,6925.3,6928.0,6929.0,6930.0,6930.1,6930.2,6934.0,6935.0,6936.1,6937.0,6939.0,6940.0,6940.1,6942.0,6942.1,6944.0,6945.0,6951.0,6952.0,6954.0,6954.1,6959.0,6960.0,6960.1,6960.2,6961.0,6963.0,6964.0,6966.0,6966.1,6966.2,6968.0,6968.1,6968.2,6968.3,6968.4,6969.0,7203.0,9574.0,11019.1,12000.0,12001.0,12002.0,12002.1,12003.0,12004.0,12005.0,12005.1,12006.0,12007.0,12008.0,12009.0,12010.0,12011.0,12012.0,12013.0,12014.0,12014.1,12015.0,12015.1,12016.0,12017.0,12018.0,12019.0,12020.0,12021.0,12023.0,12023.1,12024.0,12025.0,12025.1,12026.0,12027.0,12621.0,12621.1,12621.2,12622.0,12622.1,12622.2,12623.0,12623.1,12623.2,12624.0,12624.1,12624.2,12626.0,12626.1,12626.2,12627.0,12627.1,12627.2,12628.0,12628.1,12628.2,12629.0,12629.1,12631.0,12631.1,12633.0,12633.1,12633.2,12634.0,12634.1,12634.2,12635.0,12635.1,12635.2,12636.0,12636.1,12636.2,12637.0,12637.1,12637.2,12638.0,12638.1,12638.2,12639.0,12639.1,12639.2,12641.0,12641.1,12641.2,12642.0,12642.1,12643.0,12643.1,12644.0,12644.1,12645.0,12645.1,12645.2,12646.0,12646.1,12646.2,12648.0,12648.1,12648.2,12649.0,12649.1,12649.2,12650.0,12650.1,12651.0,12651.1,12651.2,12652.0,12652.1,12652.2,12653.0,12653.1,12654.0,12654.1,12654.2,12655.0,12655.1,12655.2,12656.0,12656.1,12656.2,12658.0,12658.1,12659.0,12659.1,12660.0,12660.1,12660.2,12661.0,12661.1,12662.0,12662.1,12663.0,12663.1,12663.2,12664.0,12664.1,12664.2,12665.0,12665.1,12666.0,12666.1,12667.0,12667.1,12667.2,12668.0,12668.1,12669.0,12669.1,12673.0,12676.0,12677.0,12679.0,12680.0,12681.0,12682.0,12683.0,12685.0,12686.0,12687.0,12688.0,12689.0,12690.0,12693.0,12694.0,12695.0,12696.0,12697.0,12698.0,12699.0,12700.0,12701.0,12702.0,12703.0,12704.0,12705.0,12706.0,12707.0,12708.0,12709.0,12710.0,12711.0,12712.0,12713.0</sig_subsig_ids>
    </category>
    <category  name="Ident"  cli_name="ident">
      <sigids>6200,6201,6202</sigids>
      <sig_subsig_ids>6200.0,6201.0,6202.1,6202.2</sig_subsig_ids>
    </category>
    <category  name="NNTP"  cli_name="nntp">
      <sigids>3575,3576,5414,5525,5908</sigids>
      <sig_subsig_ids>3575.0,3576.0,5414.0,5525.0,5908.0,5908.1,5908.2</sig_subsig_ids>
    </category>
    <category  name="LPR"  cli_name="lpr">
      <sigids>3787,3788,3791,5675,6210,6211</sigids>
      <sig_subsig_ids>3787.0,3788.0,3791.0,5675.0,6210.0,6211.0</sig_subsig_ids>
    </category>
    <category  name="NETBIOS/SMB"  cli_name="netbios/smb">
      <sigids>3300,3301,3302,3303,3304,3305,3306,3308,3309,3310,3311,3312,3313,3314,3315,3316,3320,3321,3322,3323,3324,3325,3326,3328,3334,3335,3336,3339,3341,3343,3347,3348,3349,3350,3351,3352,3353,3356,3357,4068,5177,5493,5496,5502,5547,5565,5570,5575,5576,5577,5578,5579,5580,5581,5582,5583,5584,5585,5586,5587,5589,5590,5591,5592,5593,5594,5595,5596,5598,5599,5600,5602,5605,5606,5639,5708,5738,5785,5793,5794,5799,5822,5858,6131,6255,6769</sigids>
      <sig_subsig_ids>3300.0,3301.0,3302.0,3303.0,3304.0,3305.0,3306.0,3308.0,3309.0,3310.0,3311.0,3312.0,3313.0,3314.0,3314.1,3314.2,3315.0,3316.0,3320.0,3321.0,3322.0,3323.0,3324.0,3325.0,3326.0,3328.0,3334.0,3334.1,3335.0,3336.0,3339.0,3341.0,3343.0,3347.1,3348.0,3349.0,3350.0,3351.0,3352.0,3353.0,3353.1,3353.2,3356.0,3357.0,4068.0,5177.0,5177.1,5493.0,5496.0,5502.0,5502.1,5502.2,5502.3,5502.4,5547.0,5565.0,5565.1,5565.2,5565.3,5570.0,5575.0,5576.0,5577.0,5578.0,5579.0,5579.1,5580.0,5581.0,5582.0,5583.0,5584.0,5585.0,5586.0,5587.0,5589.0,5590.0,5590.1,5591.0,5591.1,5592.0,5593.0,5594.0,5595.0,5596.0,5598.0,5598.1,5599.0,5600.0,5602.0,5605.0,5606.0,5639.0,5708.0,5738.1,5785.0,5793.0,5794.0,5794.1,5794.2,5799.0,5799.1,5799.2,5799.3,5799.4,5799.5,5799.6,5799.7,5822.0,5822.1,5822.2,5858.1,5858.2,5858.3,6131.0,6131.3,6131.4,6131.6,6255.0,6769.0</sig_subsig_ids>
    </category>
    <category  name="NTP"  cli_name="ntp">
      <sigids>4056</sigids>
      <sig_subsig_ids>4056.0</sig_subsig_ids>
    </category>
    <category  name="R-Services"  cli_name="r-services">
      <sigids>3500,3501,3502,5430,6117,6252</sigids>
      <sig_subsig_ids>3500.0,3501.0,3502.0,5430.0,5430.1,5430.2,6117.0,6252.0</sig_subsig_ids>
    </category>
    <category  name="RPC"  cli_name="rpc">
      <sigids>5571,5635,5850,6100,6101,6102,6103,6104,6105,6110,6111,6112,6113,6114,6115,6116,6117,6118,6120,6121,6122,6123,6124,6125,6126,6127,6128,6150,6151,6152,6153,6154,6155,6175,6180,6188,6189,6190,6191,6192,6193,6194,6195,6196,6197,6198,6199,6203,6242,6275,6276,6277</sigids>
      <sig_subsig_ids>5571.0,5635.0,5635.1,5850.0,5850.1,6100.0,6100.1,6101.0,6101.1,6102.0,6102.1,6103.0,6103.1,6104.0,6104.1,6105.0,6105.1,6110.0,6110.1,6111.0,6111.1,6112.0,6112.1,6113.1,6114.0,6114.1,6115.0,6115.1,6116.0,6116.1,6117.1,6118.0,6118.1,6120.0,6120.1,6121.0,6121.1,6122.0,6122.1,6123.0,6123.1,6124.0,6124.1,6125.0,6125.1,6126.0,6126.1,6127.0,6127.1,6128.0,6128.1,6150.0,6150.1,6151.0,6151.1,6152.0,6152.1,6153.0,6153.1,6154.0,6154.1,6155.0,6155.1,6175.0,6175.1,6180.0,6180.1,6188.0,6189.0,6189.1,6190.0,6190.1,6191.0,6191.1,6192.0,6192.1,6193.0,6193.1,6194.0,6194.1,6195.0,6195.1,6196.0,6196.1,6197.0,6197.1,6198.0,6198.1,6199.0,6199.1,6203.0,6203.1,6242.0,6275.0,6275.1,6276.0,6276.1,6277.0,6277.1</sig_subsig_ids>
    </category>
    <category  name="SNMP"  cli_name="snmp">
      <sigids>4500,4501,4502,4503,4504,4505,4506,4507,4508,4509,4510,4511,4512,4513,4514,4515,4516,5512,5513,5514,5838,5841,6003,6546</sigids>
      <sig_subsig_ids>4500.0,4500.1,4501.0,4502.0,4503.0,4503.1,4504.0,4505.0,4506.0,4507.0,4507.1,4507.2,4507.3,4507.4,4507.5,4507.6,4507.7,4507.8,4507.9,4507.10,4507.11,4507.12,4507.13,4507.14,4507.15,4507.16,4507.17,4507.18,4507.19,4507.20,4507.21,4507.22,4507.23,4507.24,4507.25,4507.26,4507.27,4507.28,4507.29,4507.30,4507.31,4507.32,4507.33,4507.34,4507.35,4507.36,4507.37,4508.0,4509.0,4510.0,4511.0,4512.0,4513.0,4514.0,4515.0,4515.1,4516.0,5512.0,5513.0,5514.0,5514.1,5838.0,5841.0,6003.0,6546.0</sig_subsig_ids>
    </category>
    <category  name="SSH"  cli_name="ssh">
      <sigids>3650,3651,3652,3653,3654,5767,5810,11233</sigids>
      <sig_subsig_ids>3650.0,3651.0,3652.0,3653.0,3654.0,5767.0,5810.0,11233.0,11233.1,11233.2,11233.3</sig_subsig_ids>
    </category>
    <category  name="Telnet"  cli_name="telnet">
      <sigids>3400,3401,3402,3403,3404,3405,3406,3407,3408,3531,3600,3601,3792,5526,5555,5653,5842,5861,6251</sigids>
      <sig_subsig_ids>3400.0,3401.0,3401.1,3402.0,3402.1,3402.2,3402.3,3402.4,3403.0,3404.0,3404.1,3405.0,3406.0,3407.0,3408.0,3531.0,3600.0,3601.0,3792.0,5526.0,5555.0,5653.0,5842.0,5861.1,6251.0</sig_subsig_ids>
    </category>
    <category  name="SOCKS"  cli_name="socks">
      <sigids>3409,3708</sigids>
      <sig_subsig_ids>3409.1,3708.0</sig_subsig_ids>
    </category>
    <category  name="TFTP"  cli_name="tftp">
      <sigids>4100,4101,4606,4611,4612,4613,4614,5509,5510</sigids>
      <sig_subsig_ids>4100.0,4101.0,4606.0,4606.1,4611.0,4611.1,4612.0,4612.1,4613.0,4613.1,4614.0,4614.1,5509.0,5510.0</sig_subsig_ids>
    </category>
    <category  name="HTTPS"  cli_name="https">
      <sigids>5329,5330,5403,5407,5426,5663,5747,5812,6005</sigids>
      <sig_subsig_ids>5329.0,5330.0,5403.0,5407.0,5426.0,5663.0,5747.2,5812.0,5812.1,6005.0</sig_subsig_ids>
    </category>
    <category  name="MSRPC"  cli_name="msrpc">
      <sigids>3317,3318,3319,3327,3328,3329,3330,3331,3332,3333,3334,3337,3338,3342,3344,3345,3346,5489,5565,5567,5583,5588,5597,5601,5603,5635,5644,5738,5776,5809,5843,5858,6030,6130,6131,6232,6946</sigids>
      <sig_subsig_ids>3317.0,3318.0,3319.0,3327.0,3327.1,3327.2,3327.3,3327.4,3327.5,3327.6,3327.7,3327.8,3327.9,3327.10,3327.11,3327.12,3328.1,3328.2,3328.3,3329.0,3330.0,3331.0,3331.1,3331.2,3331.3,3331.4,3332.0,3333.0,3334.0,3334.1,3334.2,3334.3,3334.4,3334.5,3334.6,3334.7,3334.8,3337.0,3338.0,3338.1,3338.2,3338.3,3342.0,3342.1,3344.0,3345.0,3346.0,5489.2,5565.4,5567.0,5567.1,5567.2,5567.3,5567.4,5567.5,5567.6,5567.7,5567.8,5583.0,5588.0,5588.1,5597.0,5601.0,5601.1,5603.0,5635.0,5635.1,5635.2,5644.0,5644.1,5644.2,5644.3,5738.0,5738.1,5738.2,5738.3,5738.4,5776.0,5776.1,5776.2,5776.3,5776.4,5809.0,5809.1,5809.2,5809.3,5843.0,5858.0,5858.5,6030.0,6130.0,6130.1,6130.6,6131.0,6131.1,6131.2,6131.5,6131.7,6131.10,6131.11,6232.0,6946.0</sig_subsig_ids>
    </category>
  </category>
  <category name="DoS" cli_name="dos">
    <category  name="ICMP Floods"  cli_name="icmp_floods">
      <sigids>2152,2153,2157,6901,6902,6903</sigids>
      <sig_subsig_ids>2152.0,2153.0,2157.0,2157.1,2157.2,6901.0,6902.0,6903.0</sig_subsig_ids>
    </category>
    <category  name="TCP Floods"  cli_name="tcp_floods">
      <sigids>3051,3178,3300,3344,3345,3653,4068,5222,5784,5785,5786,5787,5788,5835,6009,6920</sigids>
      <sig_subsig_ids>3051.0,3051.1,3178.0,3300.0,3344.0,3345.0,3653.0,4068.0,5222.0,5784.0,5785.0,5786.0,5787.0,5788.0,5835.1,5835.5,5835.6,5835.7,6009.0,6920.0</sig_subsig_ids>
    </category>
    <category  name="UDP Floods"  cli_name="udp_floods">
      <sigids>4002,4061,4513,4608,5835,5912,6910</sigids>
      <sig_subsig_ids>4002.0,4061.0,4513.0,4608.0,4608.1,4608.2,4608.3,4608.4,4608.5,5835.0,5835.2,5835.3,5835.4,5912.0,6910.0</sig_subsig_ids>
    </category>
  </category>
  <category name="Reconnaissance" cli_name="reconnaissance">
    <category  name="ICMP Host Sweeps"  cli_name="icmp_host_sweeps">
      <sigids>2100,2101,2102,2156</sigids>
      <sig_subsig_ids>2100.0,2101.0,2102.0,2156.0</sig_subsig_ids>
    </category>
    <category  name="UDP Port Sweeps"  cli_name="udp_port_sweeps">
      <sigids>4001,4003</sigids>
      <sig_subsig_ids>4001.0,4003.0</sig_subsig_ids>
    </category>
    <category  name="TCP Ports Sweeps"  cli_name="tcp_ports_sweeps">
      <sigids>3001,3002,3003,3005,3006,3010,3011,3012,3015,3016,3020,3021,3030,3031,3032,3033,3034,3035,3036,3037,3038,3039,3040,3041,3042,3043,5784,5785,5786,5787</sigids>
      <sig_subsig_ids>3001.0,3002.0,3003.0,3005.0,3006.0,3010.0,3011.0,3012.0,3015.0,3016.0,3020.0,3021.0,3030.0,3031.0,3032.0,3033.0,3034.0,3035.0,3036.0,3037.0,3038.0,3039.0,3040.0,3041.0,3042.0,3043.0,5784.0,5785.0,5786.0,5787.0</sig_subsig_ids>
    </category>
    <category  name="TCP/UDP Combo Sweeps"  cli_name="tcp/udp_combo_sweeps">
      <sigids></sigids>
      <sig_subsig_ids></sig_subsig_ids>
    </category>
  </category>
  <category name="L2/L3/L4 Protocol" cli_name="l2/l3/l4_protocol">
    <category  name="ARP"  cli_name="arp">
      <sigids>7101,7102,7104,7105</sigids>
      <sig_subsig_ids>7101.0,7102.0,7104.0,7105.0</sig_subsig_ids>
    </category>
    <category name="IP" cli_name="ip">
      <category name="General IP"  cli_name="general_ip">
        <sigids>1000,1001,1002,1003,1004,1005,1006,1007,1101,1102,1104,1107,1108,1109,1250,1308,5561,5728,5832,6764</sigids>
        <sig_subsig_ids>1000.0,1001.0,1002.0,1003.0,1004.0,1005.0,1006.0,1007.0,1101.0,1102.0,1104.0,1107.0,1108.0,1109.0,1250.0,1308.0,5561.2,5728.0,5832.1,5832.2,6764.0,6764.1</sig_subsig_ids>
      </category>
      <category  name="TCP"  cli_name="tcp">
        <sigids>1300,1301,1302,1303,1304,1305,1306,1307,1309,1310,1311,1312,1313,1314,1315,1316,1330,3001,3002,3003,3005,3006,3010,3011,3012,3015,3016,3020,3021,3030,3031,3032,3033,3034,3035,3036,3037,3038,3039,3040,3041,3042,3043,3045,3046,3050,3051,3052,3100,3101,3102,3103,3104,3105,3106,3107,3108,3109,3110,3111,3112,3113,3114,3115,3116,3117,3118,3119,3120,3121,3122,3123,3124,3125,3126,3127,3128,3129,3130,3131,3132,3133,3134,3135,3136,3137,3138,3139,3140,3141,3142,3143,3144,3145,3146,3150,3151,3152,3153,3154,3155,3156,3157,3158,3159,3160,3161,3162,3163,3164,3165,3166,3167,3168,3169,3170,3171,3172,3173,3175,3177,3178,3179,3180,3181,3200,3201,3202,3203,3204,3205,3206,3207,3208,3209,3210,3211,3212,3213,3214,3215,3216,3217,3218,3219,3220,3221,3222,3223,3224,3225,3226,3227,3228,3229,3230,3231,3232,3233,3234,3235,3236,3250,3251,3252,3253,3254,3255,3300,3302,3303,3304,3305,3306,3307,3308,3309,3310,3311,3312,3313,3314,3315,3316,3317,3318,3319,3320,3321,3322,3323,3324,3325,3326,3327,3328,3329,3330,3331,3332,3333,3334,3335,3336,3337,3338,3339,3340,3341,3342,3343,3344,3345,3346,3347,3348,3349,3350,3351,3352,3353,3356,3400,3401,3402,3403,3404,3405,3406,3407,3408,3409,3450,3451,3452,3453,3454,3455,3456,3457,3458,3459,3461,3462,3463,3464,3465,3466,3500,3501,3502,3525,3526,3527,3528,3529,3530,3531,3532,3533,3534,3537,3540,3550,3551,3575,3576,3577,3578,3600,3601,3602,3603,3604,3650,3651,3652,3653,3654,3700,3701,3702,3703,3704,3705,3706,3707,3708,3709,3710,3711,3714,3716,3718,3719,3720,3721,3728,3729,3730,3731,3732,3733,3734,3735,3736,3737,3738,3739,3740,3782,3784,3785,3786,3787,3788,3789,3790,3791,3792,3793,3802,3883,3884,3990,3991,3992,4058,4068,4151,4615,4617,5034,5035,5036,5037,5038,5039,5040,5041,5042,5043,5044,5045,5046,5047,5048,5049,5050,5051,5052,5053,5054,5055,5056,5057,5058,5059,5060,5061,5062,5063,5064,5065,5066,5067,5068,5069,5070,5071,5072,5073,5074,5075,5076,5077,5078,5079,5080,5081,5083,5084,5085,5086,5087,5088,5089,5090,5091,5092,5093,5095,5096,5097,5099,5100,5101,5102,5103,5104,5105,5106,5107,5108,5109,5110,5111,5112,5113,5114,5115,5116,5117,5118,5119,5120,5121,5122,5123,5124,5125,5126,5127,5128,5129,5130,5131,5132,5133,5134,5138,5140,5141,5142,5146,5147,5148,5149,5150,5151,5152,5154,5155,5156,5157,5158,5159,5160,5161,5162,5163,5164,5165,5166,5167,5168,5169,5170,5171,5172,5173,5174,5175,5176,5178,5179,5180,5181,5182,5183,5184,5188,5191,5194,5195,5196,5197,5199,5200,5201,5202,5203,5204,5205,5206,5207,5208,5209,5210,5211,5212,5213,5214,5215,5216,5217,5218,5219,5220,5221,5223,5224,5229,5230,5231,5232,5233,5234,5235,5236,5237,5238,5239,5240,5241,5243,5244,5245,5246,5247,5248,5251,5252,5253,5255,5256,5257,5258,5259,5260,5261,5262,5263,5265,5266,5268,5269,5270,5271,5272,5273,5274,5275,5276,5277,5278,5279,5280,5281,5282,5283,5284,5285,5286,5287,5288,5289,5290,5291,5292,5293,5294,5295,5296,5297,5298,5299,5300,5301,5302,5303,5304,5305,5306,5307,5308,5309,5310,5311,5312,5313,5314,5315,5316,5317,5318,5319,5320,5321,5322,5323,5324,5325,5326,5327,5328,5329,5330,5331,5332,5333,5334,5335,5336,5337,5338,5339,5340,5341,5342,5343,5344,5345,5346,5348,5349,5350,5351,5352,5353,5354,5355,5356,5357,5358,5359,5360,5362,5363,5364,5365,5366,5367,5368,5369,5370,5371,5372,5373,5374,5375,5376,5377,5378,5379,5380,5381,5382,5383,5385,5386,5388,5389,5390,5391,5392,5393,5394,5395,5397,5399,5400,5401,5402,5403,5405,5406,5407,5408,5409,5410,5411,5412,5413,5414,5416,5417,5418,5419,5420,5421,5422,5423,5424,5425,5426,5427,5428,5429,5430,5431,5432,5433,5434,5435,5436,5437,5438,5439,5440,5441,5442,5443,5444,5445,5446,5447,5448,5449,5450,5451,5452,5453,5454,5455,5456,5457,5458,5459,5460,5461,5462,5463,5464,5465,5466,5467,5468,5469,5472,5473,5474,5475,5476,5477,5478,5479,5480,5481,5482,5483,5484,5486,5487,5488,5489,5490,5491,5492,5493,5494,5495,5496,5497,5498,5499,5500,5501,5502,5503,5515,5516,5517,5519,5520,5521,5523,5524,5525,5526,5527,5528,5531,5545,5547,5548,5549,5551,5552,5553,5554,5555,5556,5557,5558,5559,5560,5561,5562,5564,5565,5566,5567,5568,5569,5570,5571,5572,5573,5574,5575,5576,5577,5578,5579,5580,5581,5582,5583,5584,5585,5586,5587,5588,5589,5590,5591,5592,5593,5594,5595,5596,5597,5598,5599,5600,5601,5602,5603,5605,5606,5608,5609,5610,5611,5612,5613,5614,5615,5616,5617,5618,5619,5620,5621,5622,5623,5624,5625,5626,5627,5628,5629,5630,5631,5632,5633,5634,5635,5636,5637,5638,5639,5641,5642,5643,5644,5645,5646,5647,5648,5649,5650,5651,5652,5653,5654,5655,5656,5657,5658,5659,5660,5661,5662,5663,5664,5665,5666,5667,5668,5669,5671,5672,5673,5675,5676,5677,5678,5679,5680,5683,5684,5685,5686,5687,5688,5692,5693,5694,5695,5696,5697,5699,5700,5701,5703,5705,5706,5708,5710,5711,5713,5714,5715,5717,5718,5720,5722,5723,5724,5725,5726,5727,5729,5730,5731,5732,5733,5734,5735,5736,5737,5738,5739,5740,5743,5744,5745,5746,5747,5748,5749,5750,5751,5753,5754,5756,5757,5759,5760,5761,5763,5764,5765,5767,5768,5769,5770,5771,5772,5773,5774,5775,5776,5777,5778,5779,5780,5781,5782,5783,5784,5785,5786,5787,5788,5789,5790,5792,5793,5794,5796,5797,5798,5799,5800,5801,5802,5803,5804,5805,5806,5807,5809,5810,5812,5813,5814,5815,5816,5818,5819,5820,5821,5822,5823,5824,5826,5827,5828,5829,5830,5832,5833,5835,5837,5839,5840,5841,5842,5843,5845,5846,5847,5848,5849,5850,5851,5852,5854,5855,5856,5857,5858,5860,5861,5862,5863,5864,5865,5866,5868,5869,5870,5871,5873,5874,5876,5877,5878,5879,5880,5885,5887,5888,5889,5890,5892,5893,5894,5898,5899,5902,5903,5905,5906,5908,5909,5910,5915,5916,5918,5919,5920,5921,5928,5930,5931,5985,6004,6005,6007,6008,6011,6012,6017,6030,6050,6051,6052,6053,6054,6055,6056,6057,6058,6059,6060,6061,6062,6063,6068,6069,6100,6101,6102,6103,6104,6105,6122,6123,6124,6125,6126,6127,6128,6130,6131,6150,6151,6152,6153,6154,6155,6171,6175,6177,6178,6179,6180,6181,6184,6186,6187,6189,6190,6191,6192,6193,6194,6195,6196,6197,6198,6199,6200,6201,6202,6210,6211,6228,6229,6232,6234,6235,6236,6242,6246,6249,6250,6251,6252,6253,6255,6256,6258,6259,6262,6263,6264,6265,6266,6267,6268,6269,6270,6271,6272,6273,6275,6276,6277,6278,6298,6299,6350,6403,6406,6408,6409,6410,6412,6449,6500,6508,6509,6510,6512,6513,6518,6520,6521,6522,6524,6526,6527,6528,6530,6532,6533,6534,6535,6536,6537,6539,6540,6541,6543,6544,6760,6761,6765,6767,6769,6771,6773,6775,6776,6777,6778,6780,6784,6785,6786,6787,6788,6790,6792,6793,6794,6798,6799,6920,6921,6922,6923,6924,6925,6928,6929,6930,6931,6934,6935,6936,6937,6939,6940,6942,6944,6945,6946,6951,6952,6954,6959,6960,6961,6963,6964,6966,6967,6968,6969,6973,7000,7001,7201,7203,7205,9000,9001,9002,9003,9004,9005,9006,9007,9008,9009,9010,9011,9012,9013,9014,9015,9016,9017,9018,9023,9024,9025,9026,9027,9028,9029,9030,9031,9032,9033,9036,9037,9038,9039,9040,9041,9042,9043,9044,9045,9200,9201,9202,9203,9204,9205,9206,9207,9208,9209,9210,9211,9212,9213,9214,9215,9216,9217,9218,9223,9224,9225,9226,9227,9228,9229,9230,9231,9232,9233,9236,9237,9238,9239,9240,9241,9242,9243,9244,9245,9400,9401,9402,9403,9404,9405,9406,9407,9408,9409,9410,9411,9413,9414,9415,9416,9417,9419,9420,9421,9422,9423,9424,9425,9426,9427,9428,9429,9430,9431,9432,9434,9435,9436,9437,9438,9439,9440,9441,9442,9443,9444,9445,9446,9447,9449,9451,9452,9453,9454,9455,9456,9457,9458,9459,9460,9461,9462,9463,9464,9465,9466,9467,9468,9469,9470,9471,9472,9473,9474,9475,9476,9477,9478,9479,9480,9481,9482,9483,9484,9485,9486,9487,9488,9489,9490,9491,9492,9493,9494,9495,9496,9497,9498,9499,9500,9501,9502,9503,9504,9505,9506,9507,9508,9509,9510,9511,9512,9513,9514,9515,9516,9517,9518,9519,9520,9521,9522,9523,9524,9525,9527,9528,9529,9530,9531,9532,9533,9534,9535,9536,9537,9538,9539,9540,9541,9542,9543,9544,9545,9546,9547,9548,9549,9550,9551,9552,9553,9554,9555,9556,9557,9558,9560,9561,9562,9563,9564,9565,9566,9567,9570,9571,9572,9573,9574,9575,9576,9577,9578,9579,9580,9581,9582,11000,11001,11002,11003,11004,11005,11006,11007,11008,11009,11010,11011,11012,11013,11014,11015,11016,11017,11018,11019,11020,11023,11024,11025,11026,11028,11029,11030,11031,11200,11201,11202,11203,11204,11205,11210,11211,11212,11213,11214,11215,11216,11217,11218,11219,11221,11222,11223,11224,11225,11226,11227,11228,11229,11230,11231,11232,11233,11234,11235,11236,11237,11238,11239,11240,11241,11242,11244,11245,11246,11247,11248,11249,11250,11251,11252,12000,12001,12002,12003,12004,12005,12006,12007,12008,12009,12010,12011,12012,12013,12014,12015,12016,12017,12018,12019,12020,12021,12022,12023,12024,12025,12026,12027,12621,12622,12623,12624,12626,12627,12628,12629,12631,12633,12634,12635,12636,12637,12638,12639,12641,12642,12643,12644,12645,12646,12648,12649,12650,12651,12652,12653,12654,12655,12656,12658,12659,12660,12661,12662,12663,12664,12665,12666,12667,12668,12669,12673,12676,12677,12678,12679,12680,12681,12682,12683,12685,12686,12687,12688,12689,12690,12693,12694,12695,12696,12697,12698,12699,12700,12701,12702,12703,12704,12705,12706,12707,12708,12709,12710,12711,12712,12713,12900,12901,12902,12903,12904,12905,12906,12907,12908,12909,12910,12911,12912,12913,12914,12915,12916,12917,12918,12919,12920,12921,12922,12923,12924,12925,12926,12927,12928,12929,12930,12931,12932,12933,13000,13003,13006,50000</sigids>
        <sig_subsig_ids>1300.0,1301.0,1302.0,1303.0,1304.0,1305.0,1306.0,1306.1,1306.2,1306.3,1306.4,1306.5,1306.6,1307.0,1309.0,1310.0,1311.0,1312.0,1313.0,1314.0,1315.0,1316.0,1330.0,1330.1,1330.2,1330.3,1330.4,1330.5,1330.6,1330.7,1330.8,1330.9,1330.10,1330.11,1330.12,1330.13,1330.14,1330.15,1330.16,1330.17,1330.18,1330.19,1330.20,1330.21,3001.0,3002.0,3003.0,3005.0,3006.0,3010.0,3011.0,3012.0,3015.0,3016.0,3020.0,3021.0,3030.0,3031.0,3032.0,3033.0,3034.0,3035.0,3036.0,3037.0,3038.0,3039.0,3040.0,3041.0,3042.0,3043.0,3045.0,3046.0,3050.0,3051.0,3051.1,3052.0,3100.0,3101.0,3102.0,3103.0,3103.1,3104.0,3104.1,3105.0,3106.0,3107.0,3108.0,3109.0,3109.1,3110.0,3111.0,3111.1,3112.0,3113.0,3113.1,3114.0,3115.0,3115.3,3116.0,3117.0,3117.1,3118.0,3119.0,3120.0,3120.1,3121.0,3122.0,3123.0,3124.0,3125.0,3126.0,3127.0,3128.0,3128.1,3129.0,3130.0,3131.0,3132.0,3132.1,3133.0,3133.1,3134.0,3135.0,3135.1,3135.2,3135.3,3135.4,3135.5,3135.6,3135.7,3136.0,3136.1,3136.2,3136.3,3136.4,3136.5,3136.6,3136.7,3136.8,3136.9,3136.10,3136.11,3137.0,3137.1,3137.2,3137.3,3137.4,3137.5,3137.6,3138.0,3139.0,3140.0,3140.1,3140.2,3140.3,3140.4,3140.5,3140.6,3140.7,3140.8,3140.9,3140.10,3140.11,3140.12,3140.13,3140.14,3140.15,3140.16,3140.17,3140.18,3140.19,3141.0,3142.0,3142.3,3143.0,3144.0,3145.0,3145.1,3146.0,3150.0,3150.1,3151.0,3152.0,3153.0,3154.0,3155.0,3156.0,3157.0,3158.0,3159.0,3160.0,3161.0,3161.1,3162.0,3163.0,3164.0,3165.0,3166.0,3167.0,3168.0,3169.0,3170.0,3171.0,3171.1,3172.0,3173.0,3175.0,3177.0,3178.0,3179.0,3180.0,3180.1,3181.0,3200.0,3201.1,3201.2,3201.3,3201.4,3201.5,3201.6,3202.0,3203.0,3204.0,3205.0,3206.0,3207.0,3208.0,3209.0,3210.0,3210.1,3210.2,3210.3,3211.0,3211.1,3211.2,3211.3,3212.0,3213.0,3214.0,3215.0,3216.0,3217.0,3218.0,3219.0,3220.0,3221.0,3222.0,3223.0,3224.0,3225.0,3226.0,3227.0,3228.0,3229.0,3230.0,3231.0,3232.0,3233.0,3234.0,3234.1,3235.0,3235.1,3236.0,3250.0,3251.0,3252.0,3253.0,3254.0,3254.1,3255.0,3300.0,3302.0,3303.0,3304.0,3305.0,3306.0,3307.0,3308.0,3309.0,3310.0,3311.0,3312.0,3313.0,3314.0,3314.1,3314.2,3315.0,3316.0,3317.0,3318.0,3319.0,3320.0,3321.0,3322.0,3323.0,3324.0,3325.0,3326.0,3327.0,3327.1,3327.2,3327.3,3327.4,3327.6,3327.7,3327.8,3327.9,3327.10,3327.11,3327.12,3327.13,3328.0,3328.1,3328.2,3328.3,3329.0,3330.0,3331.1,3332.0,3333.0,3334.0,3334.1,3334.2,3334.3,3334.4,3334.6,3334.7,3334.8,3335.0,3336.0,3337.0,3338.0,3338.1,3338.2,3338.3,3339.0,3340.0,3341.0,3342.0,3342.1,3343.0,3344.0,3345.0,3346.0,3347.0,3347.1,3347.2,3348.0,3349.0,3350.0,3351.0,3352.0,3353.0,3353.1,3353.2,3356.0,3400.0,3401.0,3401.1,3402.0,3402.1,3402.2,3402.3,3402.4,3403.0,3404.0,3404.1,3405.0,3406.0,3407.0,3408.0,3409.0,3409.1,3409.2,3409.3,3450.0,3451.0,3452.0,3453.0,3454.0,3455.0,3456.0,3456.1,3456.3,3457.0,3458.0,3459.0,3459.1,3461.0,3462.0,3463.0,3464.0,3465.0,3466.0,3500.0,3501.0,3502.0,3525.0,3526.0,3527.0,3527.3,3527.6,3528.0,3529.0,3530.0,3531.0,3532.0,3533.0,3534.0,3537.0,3540.0,3550.0,3551.0,3575.0,3576.0,3577.0,3578.0,3600.0,3601.0,3602.0,3603.0,3604.0,3650.0,3651.0,3652.0,3653.0,3654.0,3700.0,3701.0,3702.0,3703.0,3704.0,3705.0,3706.0,3707.0,3708.0,3709.0,3710.0,3711.0,3714.0,3716.0,3718.0,3719.0,3720.0,3721.0,3728.0,3729.0,3730.0,3731.0,3732.0,3733.0,3734.0,3735.0,3736.0,3737.0,3738.0,3739.0,3740.0,3782.0,3784.0,3785.0,3786.0,3787.0,3788.0,3789.0,3790.0,3791.0,3792.0,3793.0,3802.0,3883.0,3884.0,3990.1,3990.2,3991.0,3992.1,3992.2,3992.3,3992.4,3992.5,4058.1,4068.0,4151.0,4151.1,4615.1,4617.0,4617.1,5034.0,5035.0,5036.1,5036.2,5037.0,5038.0,5039.0,5040.1,5040.2,5040.3,5041.0,5042.1,5042.2,5042.3,5042.4,5042.5,5042.6,5043.1,5043.2,5043.3,5044.0,5045.0,5046.0,5047.0,5048.0,5049.0,5050.0,5051.0,5051.1,5051.2,5052.0,5053.0,5054.0,5055.0,5056.0,5057.0,5057.1,5058.0,5059.0,5059.1,5059.2,5060.0,5061.0,5062.0,5063.0,5064.0,5065.0,5066.0,5067.0,5068.0,5069.0,5070.0,5071.0,5072.0,5073.0,5074.0,5075.0,5076.0,5077.0,5078.0,5079.0,5080.0,5081.0,5083.0,5084.0,5084.1,5085.0,5086.0,5087.0,5087.1,5088.0,5089.0,5090.0,5091.0,5091.1,5092.0,5093.0,5095.0,5096.0,5097.0,5097.1,5097.2,5099.0,5100.0,5101.0,5102.0,5103.0,5104.0,5105.0,5106.0,5107.0,5108.0,5108.1,5108.2,5109.0,5109.1,5110.0,5111.0,5112.0,5113.0,5114.0,5114.1,5114.2,5114.3,5114.4,5114.5,5114.6,5114.7,5114.8,5115.0,5115.1,5115.2,5115.3,5115.4,5115.5,5115.6,5116.0,5117.0,5118.0,5119.0,5120.0,5121.0,5122.0,5123.0,5124.0,5124.1,5124.2,5125.0,5126.0,5127.0,5128.0,5129.0,5130.0,5131.0,5132.0,5133.0,5134.0,5138.0,5140.0,5141.0,5142.0,5142.1,5146.0,5146.1,5146.2,5146.3,5146.4,5146.5,5146.6,5146.7,5146.8,5146.9,5146.10,5146.11,5146.12,5146.13,5146.14,5146.15,5146.16,5146.17,5147.0,5148.0,5149.0,5150.0,5151.0,5152.0,5154.0,5155.0,5156.0,5157.0,5158.0,5159.0,5160.0,5161.0,5162.0,5163.0,5164.0,5165.0,5166.0,5167.0,5168.0,5169.0,5170.0,5170.1,5171.0,5172.0,5173.0,5174.0,5175.0,5176.0,5178.0,5179.0,5180.0,5181.0,5181.1,5182.0,5183.0,5184.0,5188.0,5188.1,5188.2,5188.3,5191.0,5194.0,5194.1,5194.2,5195.0,5196.0,5196.1,5197.0,5199.0,5200.0,5201.0,5201.1,5201.2,5202.0,5202.1,5203.0,5204.0,5204.1,5205.0,5206.0,5207.0,5207.1,5208.0,5209.0,5210.0,5210.1,5211.0,5212.0,5213.0,5214.0,5215.0,5215.1,5216.0,5216.1,5217.0,5218.0,5219.0,5220.0,5221.0,5221.1,5221.2,5221.3,5221.4,5223.0,5224.0,5229.0,5230.0,5231.0,5232.0,5232.1,5233.0,5234.0,5234.1,5235.0,5236.0,5237.0,5238.0,5239.0,5240.0,5241.0,5243.0,5243.1,5243.2,5243.3,5243.4,5243.5,5243.6,5244.0,5245.0,5246.0,5247.0,5248.0,5251.0,5252.0,5253.0,5255.0,5256.0,5257.0,5258.0,5259.0,5260.0,5261.0,5262.0,5263.0,5265.0,5266.0,5268.0,5269.0,5270.0,5271.0,5272.0,5273.0,5273.1,5273.2,5273.3,5274.0,5274.1,5275.0,5275.1,5276.0,5276.1,5276.2,5277.0,5278.0,5279.0,5280.0,5281.0,5282.0,5282.1,5282.2,5283.0,5284.0,5285.0,5286.0,5287.0,5288.0,5289.0,5290.0,5291.0,5292.0,5293.0,5294.0,5295.0,5296.0,5297.0,5298.0,5299.0,5300.0,5301.0,5302.0,5303.0,5304.0,5305.0,5305.1,5305.2,5305.3,5306.0,5307.0,5308.0,5309.0,5310.0,5311.0,5312.0,5313.0,5314.0,5315.0,5316.0,5317.0,5318.0,5319.0,5320.0,5321.0,5322.0,5322.1,5323.0,5324.0,5325.0,5326.0,5327.0,5328.0,5329.0,5330.0,5331.0,5332.0,5333.0,5333.1,5334.0,5335.0,5336.0,5337.0,5338.0,5339.0,5340.0,5341.0,5342.0,5343.0,5344.0,5345.0,5346.0,5348.0,5349.0,5350.0,5351.0,5352.0,5353.0,5354.0,5355.0,5356.0,5357.0,5358.0,5359.0,5360.0,5362.0,5363.0,5364.0,5365.0,5366.0,5367.0,5368.0,5369.0,5370.0,5371.0,5372.0,5373.0,5374.0,5374.1,5375.0,5376.0,5377.0,5378.0,5379.0,5380.0,5381.0,5382.0,5383.0,5383.1,5383.2,5385.0,5386.0,5388.0,5388.1,5388.2,5388.3,5389.0,5390.0,5391.0,5392.0,5393.0,5394.0,5395.0,5397.0,5399.0,5400.0,5401.0,5402.0,5403.0,5405.0,5406.0,5406.1,5407.0,5408.0,5408.1,5409.0,5409.1,5410.0,5411.0,5412.0,5413.0,5414.0,5416.0,5416.1,5417.0,5418.0,5419.0,5420.0,5421.0,5422.0,5423.0,5424.0,5425.0,5426.0,5427.0,5428.0,5428.1,5429.0,5429.1,5430.0,5431.0,5431.1,5432.0,5433.0,5434.0,5434.1,5435.0,5436.0,5436.1,5437.0,5438.0,5439.0,5440.0,5441.0,5442.0,5443.0,5444.0,5445.0,5446.0,5447.0,5448.0,5449.0,5450.0,5451.0,5452.0,5453.0,5453.1,5454.0,5455.0,5455.1,5456.0,5457.0,5458.0,5459.0,5460.0,5461.0,5462.0,5463.0,5463.1,5464.0,5465.0,5466.0,5467.0,5468.0,5469.0,5472.0,5473.0,5474.0,5474.1,5475.0,5476.0,5477.0,5477.1,5477.2,5478.0,5478.1,5479.0,5480.0,5481.0,5482.0,5483.0,5484.0,5486.0,5487.0,5488.0,5489.0,5489.1,5489.2,5489.3,5489.4,5489.5,5489.6,5489.7,5490.0,5491.0,5492.0,5493.0,5494.0,5495.0,5496.0,5497.0,5498.0,5499.0,5500.0,5501.0,5502.0,5502.1,5502.2,5502.3,5502.4,5503.0,5515.0,5516.0,5517.0,5519.0,5520.0,5521.0,5523.0,5524.0,5525.0,5526.0,5527.0,5528.0,5531.0,5545.0,5545.1,5547.0,5548.0,5549.0,5551.0,5552.0,5553.0,5554.0,5555.0,5556.0,5556.1,5556.2,5556.3,5556.4,5557.0,5557.1,5557.2,5558.0,5559.0,5560.0,5561.0,5561.1,5561.2,5562.0,5564.0,5565.0,5565.1,5565.2,5565.3,5565.4,5566.0,5567.0,5567.1,5567.2,5567.3,5567.4,5567.5,5567.6,5567.7,5567.8,5568.0,5569.0,5570.0,5571.0,5572.0,5572.1,5572.2,5573.0,5574.0,5575.0,5576.0,5577.0,5578.0,5579.0,5579.1,5580.0,5581.0,5582.0,5583.0,5584.0,5585.0,5586.0,5587.0,5588.0,5588.1,5589.0,5590.0,5590.1,5591.0,5591.1,5592.0,5593.0,5594.0,5595.0,5596.0,5597.0,5598.0,5598.1,5599.0,5600.0,5601.0,5601.1,5602.0,5603.0,5605.0,5606.0,5608.0,5609.0,5609.1,5609.2,5610.0,5611.0,5612.0,5613.0,5614.0,5615.0,5616.0,5617.0,5618.0,5619.0,5619.1,5620.0,5621.0,5622.0,5623.0,5624.0,5625.0,5626.0,5627.0,5627.1,5628.0,5629.0,5630.0,5631.0,5632.0,5632.1,5633.0,5634.0,5635.0,5635.1,5635.2,5636.0,5637.0,5638.0,5639.0,5641.0,5641.1,5641.2,5642.0,5642.1,5642.2,5642.3,5643.0,5644.0,5644.1,5644.2,5644.3,5645.0,5646.0,5647.0,5648.0,5648.1,5649.0,5650.0,5651.0,5651.1,5652.0,5653.0,5654.0,5655.0,5656.0,5657.0,5658.0,5659.0,5660.0,5661.0,5662.0,5663.0,5664.0,5665.0,5666.0,5667.0,5668.0,5669.0,5671.0,5672.0,5673.0,5675.0,5676.0,5677.0,5678.0,5679.0,5680.0,5683.0,5683.1,5683.2,5684.1,5684.4,5685.0,5686.0,5687.0,5688.0,5692.0,5693.0,5693.1,5694.0,5695.0,5696.0,5696.1,5697.0,5699.0,5700.0,5701.0,5701.1,5703.0,5705.0,5706.0,5708.0,5710.0,5711.0,5713.0,5714.0,5715.0,5717.0,5718.0,5720.0,5722.0,5723.0,5724.0,5725.0,5726.0,5727.0,5729.1,5730.0,5731.1,5731.2,5732.1,5732.2,5733.0,5734.0,5735.0,5736.0,5737.0,5738.0,5738.1,5738.2,5738.3,5738.4,5739.1,5740.0,5740.1,5743.0,5744.0,5745.0,5746.0,5747.0,5747.1,5747.2,5748.0,5748.1,5748.2,5748.3,5748.4,5748.5,5749.0,5750.0,5751.0,5753.0,5754.0,5756.0,5757.0,5759.0,5759.1,5759.2,5759.3,5760.0,5761.0,5763.0,5764.0,5765.0,5767.0,5768.0,5769.0,5769.1,5770.0,5771.0,5772.0,5773.0,5773.1,5774.0,5775.0,5775.1,5776.0,5776.1,5776.2,5776.3,5776.4,5777.0,5778.0,5779.0,5780.0,5781.0,5782.0,5783.0,5784.0,5785.0,5786.0,5787.0,5788.0,5789.0,5790.0,5792.0,5793.0,5794.0,5794.1,5794.2,5796.0,5797.0,5797.1,5797.2,5797.3,5798.0,5799.0,5799.1,5799.2,5799.3,5799.4,5799.5,5799.6,5799.7,5800.0,5801.0,5801.1,5802.0,5803.0,5804.0,5804.1,5804.2,5805.0,5805.1,5806.0,5806.1,5806.2,5806.3,5806.4,5807.0,5809.0,5809.1,5809.2,5809.3,5810.0,5812.0,5812.1,5813.0,5813.1,5813.2,5813.3,5813.4,5814.0,5814.1,5814.2,5815.0,5815.1,5815.2,5816.0,5816.1,5818.0,5818.1,5818.2,5818.3,5818.4,5818.5,5818.6,5818.7,5818.8,5818.9,5818.10,5818.11,5819.0,5820.0,5821.0,5821.1,5821.2,5822.0,5822.1,5822.2,5823.0,5824.0,5826.0,5827.0,5827.1,5827.2,5828.0,5829.0,5830.0,5832.3,5833.0,5835.1,5835.5,5835.6,5835.7,5837.0,5837.1,5839.0,5840.0,5840.1,5840.2,5841.0,5842.0,5843.0,5845.0,5846.0,5847.0,5847.1,5848.0,5849.0,5850.0,5850.1,5851.0,5852.0,5854.0,5854.1,5855.0,5856.0,5856.1,5856.2,5857.0,5857.1,5857.2,5858.0,5858.1,5858.2,5858.3,5858.5,5860.0,5860.1,5861.0,5861.1,5862.0,5863.0,5863.1,5863.2,5864.0,5865.0,5865.1,5865.2,5866.0,5868.0,5869.0,5870.0,5871.0,5873.0,5874.0,5876.0,5877.0,5878.0,5879.0,5880.0,5885.0,5887.0,5888.0,5889.0,5890.0,5892.0,5893.0,5894.0,5894.1,5898.0,5899.0,5902.0,5903.0,5903.1,5903.2,5905.0,5905.1,5906.0,5908.0,5908.1,5908.2,5909.0,5910.0,5915.0,5916.0,5918.0,5918.1,5919.0,5920.0,5921.0,5928.0,5930.0,5930.1,5930.2,5930.3,5930.4,5930.5,5931.0,5931.1,5985.0,6004.0,6005.0,6007.0,6008.0,6011.0,6012.0,6017.0,6017.1,6017.2,6017.3,6017.4,6017.5,6030.0,6050.1,6051.1,6052.1,6053.1,6054.1,6055.1,6055.2,6056.1,6056.2,6057.1,6057.2,6058.1,6059.2,6060.2,6060.3,6061.1,6062.1,6063.1,6068.0,6069.0,6069.1,6069.2,6069.3,6069.4,6069.5,6069.6,6069.7,6069.8,6100.1,6101.1,6102.1,6103.1,6104.1,6105.1,6122.1,6123.1,6124.1,6125.1,6126.1,6127.1,6128.1,6130.0,6130.1,6130.2,6130.3,6130.4,6130.5,6130.6,6130.7,6130.8,6130.9,6130.10,6130.11,6131.0,6131.1,6131.2,6131.3,6131.4,6131.5,6131.6,6131.7,6131.10,6131.11,6150.1,6151.1,6152.1,6153.1,6154.1,6155.1,6171.0,6175.1,6177.0,6178.0,6179.0,6180.1,6181.0,6184.0,6186.0,6187.0,6189.1,6190.1,6191.1,6192.1,6193.1,6194.1,6195.1,6196.1,6197.0,6198.0,6199.0,6200.0,6201.0,6202.1,6202.2,6210.0,6211.0,6228.0,6228.1,6228.2,6228.3,6229.0,6229.1,6229.2,6232.0,6234.0,6235.0,6236.0,6242.0,6246.0,6246.1,6249.0,6250.0,6251.0,6252.0,6253.0,6255.0,6256.0,6258.0,6259.0,6262.0,6263.0,6264.0,6265.0,6266.0,6267.0,6268.0,6269.0,6270.0,6271.0,6272.0,6273.0,6275.1,6276.1,6277.1,6278.0,6278.1,6278.2,6298.0,6298.1,6299.0,6350.0,6403.0,6403.1,6406.0,6408.0,6408.1,6409.0,6409.1,6409.2,6410.0,6410.1,6410.2,6412.0,6449.0,6500.0,6500.1,6508.0,6509.0,6509.1,6509.2,6510.0,6510.1,6510.2,6512.0,6512.1,6512.2,6513.0,6513.1,6513.2,6518.1,6520.0,6521.0,6522.0,6524.0,6524.1,6526.0,6527.0,6528.0,6530.0,6532.0,6533.0,6534.0,6534.1,6535.0,6535.1,6536.0,6536.1,6537.0,6537.1,6539.0,6539.1,6540.0,6541.0,6543.0,6544.0,6544.1,6760.0,6760.1,6760.2,6761.0,6765.0,6767.0,6769.0,6771.0,6773.0,6775.0,6775.1,6776.0,6777.0,6777.1,6777.2,6778.0,6780.0,6780.1,6780.2,6784.0,6784.1,6784.2,6784.3,6785.0,6785.1,6785.2,6786.0,6787.0,6788.0,6788.1,6788.2,6788.3,6788.4,6790.0,6790.1,6792.0,6793.0,6793.1,6794.0,6794.1,6798.0,6799.0,6920.0,6921.0,6922.0,6923.0,6923.1,6924.0,6925.0,6925.1,6925.2,6925.3,6928.0,6929.0,6930.0,6930.1,6930.2,6931.0,6934.0,6935.0,6936.0,6936.1,6937.0,6939.0,6940.0,6940.1,6942.0,6942.1,6944.0,6945.0,6946.0,6951.0,6952.0,6954.0,6954.1,6959.0,6960.0,6960.1,6960.2,6961.0,6963.0,6964.0,6966.0,6966.1,6966.2,6967.0,6968.0,6968.1,6968.2,6968.3,6968.4,6969.0,6973.0,7000.0,7001.0,7201.0,7203.0,7205.0,9000.0,9001.0,9002.0,9003.0,9004.0,9005.0,9006.0,9007.0,9008.0,9009.0,9010.0,9011.0,9012.0,9013.0,9014.0,9015.0,9016.0,9017.0,9018.0,9023.0,9024.0,9025.0,9026.0,9027.0,9028.0,9029.0,9030.0,9031.0,9032.0,9033.0,9036.0,9037.0,9038.0,9039.0,9040.0,9041.0,9042.0,9043.0,9044.0,9045.0,9200.0,9201.0,9202.0,9203.0,9204.0,9205.0,9206.0,9207.0,9208.0,9209.0,9210.0,9211.0,9212.0,9213.0,9214.0,9215.0,9216.0,9217.0,9218.0,9223.0,9224.0,9225.0,9226.0,9227.0,9228.0,9229.0,9230.0,9231.0,9232.0,9233.0,9236.0,9237.0,9238.0,9239.0,9240.0,9241.0,9242.0,9243.0,9244.0,9245.0,9400.0,9400.1,9401.1,9402.0,9403.1,9404.0,9404.1,9405.0,9406.0,9407.0,9408.0,9409.0,9410.0,9411.0,9411.1,9411.2,9413.0,9414.0,9415.0,9416.0,9417.0,9419.0,9419.1,9420.0,9421.0,9422.0,9423.0,9423.1,9424.0,9425.0,9426.0,9427.0,9428.0,9429.0,9430.0,9431.0,9432.0,9434.0,9435.0,9436.0,9437.0,9438.0,9439.0,9440.0,9441.0,9442.0,9443.0,9444.0,9445.0,9445.1,9445.2,9446.0,9447.0,9449.0,9451.0,9452.0,9453.0,9454.0,9455.0,9456.0,9457.0,9458.0,9459.0,9460.0,9461.0,9462.0,9463.0,9464.0,9465.0,9466.0,9467.0,9468.0,9469.0,9470.0,9471.0,9472.0,9473.0,9473.1,9474.0,9475.0,9476.0,9477.0,9478.0,9479.0,9480.0,9481.0,9482.0,9483.0,9484.0,9485.0,9486.0,9487.0,9488.0,9488.1,9489.0,9490.0,9491.0,9492.0,9493.0,9494.0,9495.0,9496.0,9497.0,9498.0,9499.0,9500.0,9501.0,9502.0,9503.0,9504.0,9505.0,9506.0,9507.0,9508.0,9509.0,9510.0,9511.0,9512.0,9513.0,9514.0,9515.0,9516.0,9517.0,9518.0,9519.0,9519.1,9519.2,9520.0,9521.0,9522.0,9523.0,9524.0,9525.0,9527.0,9528.0,9529.0,9530.0,9531.0,9532.0,9533.0,9534.0,9535.0,9536.0,9537.0,9538.0,9539.0,9540.0,9541.0,9542.0,9542.1,9543.0,9544.0,9545.0,9546.0,9546.1,9546.2,9547.0,9548.0,9549.0,9550.0,9551.0,9552.0,9553.0,9554.0,9555.0,9556.0,9557.0,9558.0,9560.0,9560.1,9560.2,9561.0,9562.0,9562.1,9563.0,9563.1,9564.0,9565.0,9566.0,9567.0,9567.1,9570.0,9571.0,9572.0,9573.0,9574.0,9575.0,9576.0,9577.0,9578.0,9579.0,9580.0,9581.0,9582.0,11000.3,11001.0,11001.1,11002.0,11002.1,11003.0,11003.1,11004.0,11004.1,11005.0,11005.2,11006.0,11006.1,11007.0,11007.1,11008.0,11008.1,11009.0,11009.1,11010.0,11010.1,11011.0,11011.1,11012.0,11012.1,11013.0,11013.1,11014.0,11015.0,11016.0,11017.0,11017.1,11018.0,11018.1,11019.0,11019.1,11020.0,11020.1,11023.0,11023.1,11024.0,11025.0,11026.0,11028.0,11029.0,11030.0,11031.0,11200.0,11201.0,11202.0,11203.0,11204.0,11205.0,11210.0,11211.0,11211.1,11212.0,11213.0,11214.0,11215.0,11216.0,11217.0,11218.0,11219.0,11221.0,11222.0,11223.0,11224.0,11225.0,11226.0,11227.0,11228.0,11229.0,11230.0,11231.0,11232.0,11233.0,11233.3,11234.0,11235.0,11236.0,11237.0,11238.0,11239.0,11240.0,11241.0,11242.0,11244.0,11245.0,11245.1,11245.2,11245.3,11246.0,11247.0,11248.0,11249.0,11250.0,11251.0,11252.0,11252.1,12000.0,12001.0,12002.0,12002.1,12003.0,12004.0,12005.0,12005.1,12006.0,12007.0,12008.0,12009.0,12010.0,12011.0,12012.0,12013.0,12014.0,12014.1,12015.0,12015.1,12016.0,12017.0,12018.0,12019.0,12020.0,12021.0,12022.0,12022.1,12023.0,12023.1,12024.0,12025.0,12025.1,12026.0,12027.0,12621.0,12621.1,12621.2,12622.0,12622.1,12622.2,12623.0,12623.1,12623.2,12624.0,12624.1,12624.2,12626.0,12626.1,12626.2,12627.0,12627.1,12627.2,12628.0,12628.1,12628.2,12629.0,12629.1,12631.0,12631.1,12633.0,12633.1,12633.2,12634.0,12634.1,12634.2,12635.0,12635.1,12635.2,12636.0,12636.1,12636.2,12637.0,12637.1,12637.2,12638.0,12638.1,12638.2,12639.0,12639.1,12639.2,12641.0,12641.1,12641.2,12642.0,12642.1,12643.0,12643.1,12644.0,12644.1,12645.0,12645.1,12645.2,12646.0,12646.1,12646.2,12648.0,12648.1,12648.2,12649.0,12649.1,12649.2,12650.0,12650.1,12651.0,12651.1,12651.2,12652.0,12652.1,12652.2,12653.0,12653.1,12654.0,12654.1,12654.2,12655.0,12655.1,12655.2,12656.0,12656.1,12656.2,12658.0,12658.1,12659.0,12659.1,12660.0,12660.1,12660.2,12661.0,12661.1,12662.0,12662.1,12663.0,12663.1,12663.2,12664.0,12664.1,12664.2,12665.0,12665.1,12666.0,12666.1,12667.0,12667.1,12667.2,12668.0,12668.1,12669.0,12669.1,12673.0,12676.0,12677.0,12678.0,12679.0,12680.0,12681.0,12682.0,12683.0,12685.0,12686.0,12687.0,12688.0,12689.0,12690.0,12693.0,12694.0,12695.0,12696.0,12697.0,12698.0,12699.0,12700.0,12701.0,12702.0,12703.0,12704.0,12705.0,12706.0,12707.0,12708.0,12709.0,12710.0,12711.0,12712.0,12713.0,12900.0,12901.0,12902.0,12903.0,12904.0,12905.0,12906.0,12907.0,12908.0,12909.0,12910.0,12911.0,12912.0,12913.0,12914.0,12915.0,12916.0,12917.0,12918.0,12919.0,12920.0,12921.0,12922.0,12923.0,12924.0,12925.0,12926.0,12927.0,12928.0,12929.0,12930.0,12931.0,12932.0,12933.0,13000.0,13000.1,13003.0,13003.1,13006.0,13006.1,50000.0</sig_subsig_ids>
      </category>
      <category  name="UDP"  cli_name="udp">
        <sigids>3143,3301,3327,3331,3334,3357,3783,4001,4002,4003,4004,4050,4051,4052,4053,4054,4055,4056,4058,4060,4061,4062,4063,4067,4100,4101,4150,4500,4501,4502,4503,4504,4505,4506,4507,4508,4509,4510,4511,4512,4513,4514,4515,4516,4600,4601,4602,4603,4604,4605,4606,4607,4608,4609,4610,4611,4612,4613,4614,4615,4619,4620,4701,4702,4703,4704,5177,5430,5471,5485,5504,5505,5507,5508,5509,5510,5511,5512,5513,5514,5518,5529,5530,5532,5533,5534,5535,5536,5537,5538,5539,5540,5544,5546,5674,5681,5684,5689,5698,5716,5726,5766,5795,5825,5831,5835,5838,5853,5858,5893,5912,5913,6003,6013,6050,6051,6052,6053,6054,6055,6056,6057,6058,6059,6060,6061,6062,6063,6065,6066,6067,6100,6101,6102,6103,6104,6105,6122,6123,6124,6125,6126,6127,6128,6150,6151,6152,6153,6154,6155,6175,6180,6188,6189,6190,6191,6192,6193,6194,6195,6196,6197,6198,6199,6203,6257,6260,6261,6274,6275,6276,6277,6505,6506,6508,6515,6517,6518,6523,6545,6546,6768,6781,6782,6910,7202,9019,9020,9021,9022,9401,9403,9412,9418,9430,9433,9450,9559,9568,9583,11000,11021,11022,11027,11206,11207,11208,11209,13001,13004,13007,50000</sigids>
        <sig_subsig_ids>3143.1,3143.2,3143.3,3143.4,3301.0,3327.1,3327.5,3331.0,3331.1,3331.2,3331.3,3331.4,3334.5,3357.0,3783.0,4001.0,4002.0,4003.0,4004.0,4050.0,4051.1,4051.2,4051.3,4052.1,4052.2,4053.0,4054.0,4054.1,4055.1,4055.2,4056.0,4058.0,4058.2,4060.0,4060.1,4061.0,4062.0,4063.0,4067.0,4100.0,4101.0,4150.0,4500.0,4500.1,4501.0,4502.0,4503.0,4503.1,4504.0,4505.0,4506.0,4507.0,4507.1,4507.2,4507.3,4507.4,4507.5,4507.6,4507.7,4507.8,4507.9,4507.10,4507.11,4507.12,4507.13,4507.14,4507.15,4507.16,4507.17,4507.18,4507.19,4507.20,4507.21,4507.22,4507.23,4507.24,4507.25,4507.26,4507.27,4507.28,4507.29,4507.30,4507.31,4507.32,4507.33,4507.34,4507.35,4507.36,4507.37,4508.0,4509.0,4510.0,4511.0,4512.0,4513.0,4514.0,4515.0,4515.1,4516.0,4600.0,4601.0,4601.1,4601.2,4601.3,4602.0,4602.1,4602.3,4602.4,4603.0,4604.0,4604.1,4605.0,4605.1,4606.0,4606.1,4607.0,4607.1,4607.2,4607.3,4607.4,4607.5,4607.6,4607.7,4607.8,4607.9,4608.0,4608.1,4608.2,4608.3,4608.4,4608.5,4609.0,4609.1,4610.0,4610.1,4611.0,4611.1,4612.0,4612.1,4613.0,4613.1,4614.0,4614.1,4615.0,4615.2,4615.3,4619.0,4620.0,4701.0,4702.0,4703.0,4704.0,5177.0,5177.1,5430.1,5430.2,5471.0,5471.1,5485.0,5485.1,5504.0,5505.0,5505.1,5507.0,5508.0,5509.0,5510.0,5511.0,5512.0,5513.0,5514.0,5514.1,5518.0,5529.0,5529.1,5529.2,5529.3,5530.0,5532.0,5533.0,5534.0,5534.1,5534.2,5535.0,5536.0,5537.0,5538.0,5539.0,5540.0,5544.0,5546.0,5674.0,5681.0,5684.0,5684.2,5684.3,5684.5,5684.6,5689.0,5698.0,5716.0,5726.1,5766.0,5795.0,5825.0,5831.0,5835.0,5835.2,5835.3,5835.4,5838.0,5853.0,5858.4,5893.1,5893.2,5912.0,5913.0,5913.1,6003.0,6013.0,6013.1,6050.0,6051.0,6052.0,6053.0,6054.0,6055.0,6056.0,6057.0,6058.0,6059.0,6059.1,6060.0,6060.1,6061.0,6062.0,6063.0,6065.0,6066.0,6067.0,6100.0,6101.0,6102.0,6103.0,6104.0,6105.0,6122.0,6123.0,6124.0,6125.0,6126.0,6127.0,6128.0,6150.0,6151.0,6152.0,6153.0,6154.0,6155.0,6175.0,6180.0,6188.0,6189.0,6190.0,6191.0,6192.0,6193.0,6194.0,6195.0,6196.0,6197.1,6198.1,6199.1,6203.0,6203.1,6257.0,6260.0,6261.0,6274.0,6275.0,6276.0,6277.0,6505.0,6505.1,6506.0,6506.1,6508.1,6508.2,6515.0,6517.0,6518.0,6523.0,6545.0,6546.0,6768.0,6768.1,6768.2,6781.0,6782.0,6910.0,7202.0,9019.0,9020.0,9021.0,9022.0,9401.0,9401.2,9403.0,9403.2,9412.0,9412.1,9418.0,9418.1,9430.1,9433.0,9433.1,9450.0,9559.0,9568.0,9583.0,11000.0,11000.1,11000.2,11021.0,11022.0,11022.1,11027.0,11027.1,11206.0,11207.0,11208.0,11209.0,13001.0,13001.1,13004.0,13004.1,13007.0,13007.1,50000.1</sig_subsig_ids>
      </category>
      <category  name="IP Fragment"  cli_name="ip_fragment">
        <sigids>1200,1201,1202,1203,1204,1205,1206,1207,1208,1220,1225</sigids>
        <sig_subsig_ids>1200.0,1201.0,1202.0,1203.0,1204.0,1205.0,1206.0,1207.0,1208.0,1220.0,1225.0</sig_subsig_ids>
      </category>
      <category  name="ICMP"  cli_name="icmp">
        <sigids>1600,1601,1602,1603,1604,1605,1606,1607,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2100,2101,2102,2150,2151,2152,2153,2154,2155,2156,2157,2158,5541,5543,5832,6300,6302,6303,6501,6502,6503,6504,6755,6901,6902,6903,50000</sigids>
        <sig_subsig_ids>1600.0,1601.0,1602.0,1603.0,1604.0,1605.0,1606.0,1607.0,2000.0,2001.0,2001.1,2002.0,2003.0,2004.0,2005.0,2006.0,2007.0,2008.0,2009.0,2010.0,2011.0,2012.0,2100.0,2101.0,2102.0,2150.0,2151.0,2152.0,2153.0,2154.0,2155.0,2156.0,2157.0,2157.1,2157.2,2158.0,5541.0,5543.0,5832.0,6300.0,6302.0,6303.0,6501.0,6502.0,6503.0,6504.0,6755.0,6901.0,6902.0,6903.0,50000.2</sig_subsig_ids>
      </category>
      <category  name="IP V6"  cli_name="ip_v6">
        <sigids>1607,9510</sigids>
        <sig_subsig_ids>1607.0,9510.1</sig_subsig_ids>
      </category>
    </category>
    <category  name="General Protocol"  cli_name="general_protocol">
      <sigids>2200,2201,2202,5506,5557,5565,5567,5635,5641,5644,6064,6224,6507,6926,9572,13002,13005,13008</sigids>
      <sig_subsig_ids>2200.0,2201.0,2202.0,5506.0,5506.1,5557.0,5557.1,5565.0,5565.1,5565.3,5567.0,5635.0,5635.1,5641.1,5644.0,5644.1,5644.2,6064.0,6224.0,6507.0,6926.0,6926.1,9572.0,13002.0,13002.1,13005.0,13005.1,13008.0,13008.1</sig_subsig_ids>
    </category>
  </category>
  <category name="Instant Messaging" cli_name="instant_messaging">
    <category  name="Yahoo"  cli_name="yahoo">
      <sigids>5539,11200,11208,11212,11217,11218,11219,11221,12675</sigids>
      <sig_subsig_ids>5539.0,11200.0,11208.0,11212.0,11217.0,11218.0,11219.0,11221.0,12675.0</sig_subsig_ids>
    </category>
    <category  name="AOL"  cli_name="aol">
      <sigids>5412,5902,11202,11207,11210,11213,11214,11215,11216,11229,11230,11231,11232,11246,11247,11252</sigids>
      <sig_subsig_ids>5412.0,5902.0,11202.0,11207.0,11210.0,11210.1,11213.0,11214.0,11215.0,11216.0,11229.0,11230.0,11231.0,11232.0,11246.0,11247.0,11252.0,11252.1</sig_subsig_ids>
    </category>
    <category  name="MSN"  cli_name="msn">
      <sigids>3146,3719,5540,5899,11201,11209,11211,11222,11223,11224,11225,11226,11227,11228,11236,11238,11244</sigids>
      <sig_subsig_ids>3146.0,3719.0,5540.0,5899.0,11201.0,11209.0,11211.0,11211.1,11222.0,11223.0,11224.0,11225.0,11226.0,11227.0,11228.0,11236.0,11238.0,11244.0</sig_subsig_ids>
    </category>
    <category  name="Sametime"  cli_name="sametime">
      <sigids>11205</sigids>
      <sig_subsig_ids>11205.0</sig_subsig_ids>
    </category>
    <category  name="Jabber"  cli_name="jabber">
      <sigids>5433,11204,11234,11235,11237</sigids>
      <sig_subsig_ids>5433.0,11204.0,11234.0,11235.0,11237.0</sig_subsig_ids>
    </category>
  </category>
  <category name="Adware/Spyware" cli_name="adware/spyware">
    <category  name="All-Adware/Spyware"  cli_name="all-adware/spyware">
      <sigids>12000,12001,12002,12003,12004,12005,12006,12008,12009,12010,12011,12013,12014,12015,12016,12017,12018,12019,12020,12021,12022,12023,12024,12027</sigids>
      <sig_subsig_ids>12000.0,12001.0,12002.0,12002.1,12003.0,12004.0,12005.0,12005.1,12006.0,12008.0,12009.0,12010.0,12011.0,12013.0,12014.0,12014.1,12015.0,12015.1,12016.0,12017.0,12018.0,12019.0,12020.0,12021.0,12022.0,12022.1,12023.0,12023.1,12024.0,12027.0</sig_subsig_ids>
    </category>
  </category>
  <category name="Viruses/Worms/Trojans" cli_name="viruses/worms/trojans">
    <category  name="All-Viruses/Worms/Trojans"  cli_name="all-viruses/worms/trojans">
      <sigids>2156,2158,3111,3116,3117,3120,3123,3129,3130,3131,3132,3133,3134,3135,3136,3137,3138,3139,3140,3141,3142,3143,3144,3145,3146,3324,3335,3990,3991,3992,4053,4055,4060,4151,4602,4607,4608,4615,5329,5330,5390,5400,5436,5440,5447,5448,5449,5450,5489,5492,5506,5532,5533,5570,5571,5593,5599,5894,6013,6500,6537,6964,9003,9004,9005,9006,9007,9008,9009,9010,9011,9012,9013,9014,9015,9016,9017,9018,9019,9020,9021,9022,9023,9024,9025,9026,9027,9028,9029,9030,9031,9032,9033,9036,9037,9038,9039,9040,9041,9042,9043,9044,9045,9200,9202,9203,9204,9205,9206,9207,9208,9209,9210,9211,9212,9213,9214,9215,9216,9217,9218,9223,9224,9225,9226,9227,9228,9229,9230,9231,9232,9233,9236,9237,9238,9239,9240,9241,9242,9243,9244,9245,9400,9401,9402,9403,9404,9405,9406,9407,9408,9409,9410,9411,9412,9413,9414,9415,9416,9417,9418,9419,9420,9421,9422,9423,9424,9425,9426,9427,9428,9429,9430,9431,9432,9433,9434,9435,9436,9437,9438,9439,9440,9441,9442,9443,9444,9445,9446,9447,9449,9450,9451,9452,9453,9454,9455,9456,9457,9458,9459,9460,9461,9462,9463,9464,9465,9466,9467,9468,9469,9470,9471,9472,9473,9474,9475,9476,9477,9478,9479,9480,9481,9482,9483,9484,9485,9486,9487,9488,9489,9490,9491,9492,9493,9494,9495,9496,9497,9498,9499,9500,9501,9502,9503,9504,9505,9506,9507,9508,9509,9510,9511,9512,9513,9514,9515,9516,9517,9518,9519,9520,9521,9522,9523,9524,9525,9527,9528,9529,9530,9531,9532,9533,9534,9535,9536,9537,9538,9539,9540,9541,9542,9543,9544,9545,9546,9547,9548,9549,9550,9551,9552,9553,9554,9555,9556,9557,9558,9559,9560,9561,9562,9563,9564,9565,9566,9567,9568,9570,9571,9572,9573,9574,9575,9576,9577,9578,9579,9580,9581,9582,9583,12025,12026,13000,13001,13002,13003,13004,13005,13006,13007,13008,50000</sigids>
      <sig_subsig_ids>2156.0,2158.0,3111.0,3111.1,3116.0,3117.0,3117.1,3120.0,3120.1,3123.0,3129.0,3130.0,3131.0,3132.0,3132.1,3133.0,3133.1,3134.0,3135.0,3135.1,3135.2,3135.3,3135.4,3135.5,3135.6,3135.7,3136.0,3136.1,3136.2,3136.3,3136.4,3136.5,3136.6,3136.7,3136.8,3136.9,3136.10,3136.11,3137.0,3137.1,3137.2,3137.3,3137.4,3137.5,3137.6,3138.0,3139.0,3140.0,3140.1,3140.2,3140.3,3140.4,3140.5,3140.6,3140.7,3140.8,3140.9,3140.10,3140.11,3140.12,3140.13,3140.14,3140.15,3140.16,3140.17,3140.18,3140.19,3141.0,3142.0,3142.1,3142.3,3143.0,3143.1,3143.2,3143.3,3143.4,3144.0,3145.0,3145.1,3146.0,3324.0,3335.0,3990.1,3990.2,3991.0,3992.1,3992.2,3992.3,3992.4,4053.0,4055.1,4055.2,4060.0,4151.0,4151.1,4602.0,4602.1,4602.2,4602.3,4602.4,4607.0,4607.1,4607.2,4607.3,4607.4,4607.5,4607.6,4607.7,4607.8,4607.9,4608.1,4608.2,4608.3,4608.4,4608.5,4615.0,4615.1,4615.2,4615.3,5329.0,5330.0,5390.0,5400.0,5436.0,5436.1,5440.0,5447.0,5448.0,5449.0,5450.0,5489.0,5489.1,5489.2,5489.3,5489.4,5489.5,5489.6,5489.7,5492.0,5506.0,5506.1,5532.0,5533.0,5570.0,5571.0,5593.0,5599.0,5894.0,5894.1,6013.0,6500.0,6537.0,6537.1,6964.0,9003.0,9004.0,9005.0,9006.0,9007.0,9008.0,9009.0,9010.0,9011.0,9012.0,9013.0,9014.0,9015.0,9016.0,9017.0,9018.0,9019.0,9020.0,9021.0,9022.0,9023.0,9024.0,9025.0,9026.0,9027.0,9028.0,9029.0,9030.0,9031.0,9032.0,9033.0,9036.0,9037.0,9038.0,9039.0,9040.0,9041.0,9042.0,9043.0,9044.0,9045.0,9200.0,9202.0,9203.0,9204.0,9205.0,9206.0,9207.0,9208.0,9209.0,9210.0,9211.0,9212.0,9213.0,9214.0,9215.0,9216.0,9217.0,9218.0,9223.0,9224.0,9225.0,9226.0,9227.0,9228.0,9229.0,9230.0,9231.0,9232.0,9233.0,9236.0,9237.0,9238.0,9239.0,9240.0,9241.0,9242.0,9243.0,9244.0,9245.0,9400.0,9400.1,9401.0,9401.1,9401.2,9402.0,9403.0,9403.1,9403.2,9404.0,9404.1,9405.0,9406.0,9407.0,9408.0,9409.0,9410.0,9411.0,9411.1,9411.2,9412.0,9412.1,9413.0,9414.0,9415.0,9416.0,9417.0,9418.0,9418.1,9419.0,9419.1,9420.0,9421.0,9422.0,9423.0,9423.1,9424.0,9425.0,9426.0,9427.0,9428.0,9429.0,9430.0,9430.1,9431.0,9432.0,9433.0,9433.1,9434.0,9435.0,9436.0,9437.0,9438.0,9439.0,9440.0,9441.0,9442.0,9443.0,9444.0,9445.0,9445.1,9445.2,9446.0,9447.0,9449.0,9450.0,9451.0,9452.0,9453.0,9454.0,9455.0,9456.0,9457.0,9458.0,9459.0,9460.0,9461.0,9462.0,9463.0,9464.0,9465.0,9466.0,9467.0,9468.0,9469.0,9470.0,9471.0,9472.0,9473.0,9473.1,9474.0,9475.0,9476.0,9477.0,9478.0,9479.0,9480.0,9481.0,9482.0,9483.0,9484.0,9485.0,9486.0,9487.0,9488.0,9488.1,9489.0,9490.0,9491.0,9492.0,9493.0,9494.0,9495.0,9496.0,9497.0,9498.0,9499.0,9500.0,9501.0,9502.0,9503.0,9504.0,9505.0,9506.0,9507.0,9508.0,9509.0,9510.0,9510.1,9511.0,9512.0,9513.0,9514.0,9515.0,9516.0,9517.0,9518.0,9519.0,9519.1,9519.2,9520.0,9521.0,9522.0,9523.0,9524.0,9525.0,9527.0,9528.0,9529.0,9530.0,9531.0,9532.0,9533.0,9534.0,9535.0,9536.0,9537.0,9538.0,9539.0,9540.0,9541.0,9542.0,9542.1,9543.0,9544.0,9545.0,9546.0,9546.1,9546.2,9547.0,9548.0,9549.0,9550.0,9551.0,9552.0,9553.0,9554.0,9555.0,9556.0,9557.0,9558.0,9559.0,9560.0,9560.1,9560.2,9561.0,9562.0,9562.1,9563.0,9563.1,9564.0,9565.0,9566.0,9567.0,9567.1,9568.0,9570.0,9571.0,9572.0,9573.0,9574.0,9575.0,9576.0,9577.0,9578.0,9579.0,9580.0,9581.0,9582.0,9583.0,12025.0,12025.1,12026.0,13000.1,13001.1,13002.1,13003.1,13004.1,13005.1,13006.1,13007.1,13008.1,50000.0,50000.1,50000.2</sig_subsig_ids>
    </category>
  </category>
  <category name="DDoS" cli_name="ddos">
    <category  name="All-DDoS"  cli_name="all-ddos">
      <sigids>2153,4608</sigids>
      <sig_subsig_ids>2153.0,4608.0,4608.1,4608.2,4608.3,4608.4,4608.5</sig_subsig_ids>
    </category>
  </category>
  <category name="Network Services" cli_name="network_services">
    <category  name="DNS"  cli_name="dns">
      <sigids>3143,4004,4602,4615,4620,5429,5561,5766,5858,6013,6050,6051,6052,6053,6054,6055,6056,6057,6058,6059,6060,6061,6062,6063,6064,6065,6066,6067</sigids>
      <sig_subsig_ids>3143.1,3143.2,3143.3,3143.4,4004.0,4602.0,4602.1,4602.3,4602.4,4615.0,4615.1,4615.2,4615.3,4620.0,5429.0,5561.1,5561.2,5766.0,5858.4,6013.0,6013.1,6050.0,6050.1,6051.0,6051.1,6052.0,6052.1,6053.0,6053.1,6054.0,6054.1,6055.0,6055.1,6055.2,6056.0,6056.1,6056.2,6057.0,6057.1,6057.2,6058.0,6058.1,6059.0,6059.1,6059.2,6060.0,6060.1,6060.2,6060.3,6061.0,6061.1,6062.0,6062.1,6063.0,6063.1,6064.0,6065.0,6066.0,6067.0</sig_subsig_ids>
    </category>
    <category  name="Finger"  cli_name="finger">
      <sigids>3450,3456,3457,3461,3462,3463,3464,3465,3707,5295,5553</sigids>
      <sig_subsig_ids>3450.0,3456.0,3456.1,3456.3,3457.0,3461.0,3462.0,3463.0,3464.0,3465.0,3707.0,5295.0,5553.0</sig_subsig_ids>
    </category>
    <category  name="DHCP"  cli_name="dhcp">
      <sigids>4603,4604,4605,4619,5530,5681,5795</sigids>
      <sig_subsig_ids>4603.0,4604.0,4604.1,4605.0,4605.1,4619.0,5530.0,5681.0,5795.0</sig_subsig_ids>
    </category>
    <category  name="BGP"  cli_name="bgp">
      <sigids>3532,3533,6412</sigids>
      <sig_subsig_ids>3532.0,3533.0,6412.0</sig_subsig_ids>
    </category>
  </category>
  <category name="Web Server" cli_name="web_server">
    <category  name="Apache"  cli_name="apache">
      <sigids>3200,3201,3255,3883,5184,5194,5205,5211,5262,5290,5329,5330,5343,5367,5369,5375,5394,5427,5558,5648,5658,5664,5680,5685,5770,5828,6449,6765</sigids>
      <sig_subsig_ids>3200.0,3201.5,3201.6,3255.0,3883.0,5184.0,5194.0,5194.1,5194.2,5205.0,5211.0,5262.0,5290.0,5329.0,5330.0,5343.0,5367.0,5369.0,5375.0,5394.0,5427.0,5558.0,5648.0,5658.0,5664.0,5680.0,5685.0,5770.0,5828.0,6449.0,6765.0</sig_subsig_ids>
    </category>
    <category  name="Internet Information Server (IIS)"  cli_name="internet_information_server_(iis)">
      <sigids>3210,3211,3214,3215,3220,3704,5034,5048,5049,5050,5051,5052,5053,5061,5070,5071,5075,5085,5114,5123,5124,5126,5178,5200,5204,5246,5247,5248,5258,5259,5260,5263,5280,5282,5284,5311,5338,5344,5364,5365,5371,5372,5373,5374,5376,5405,5407,5418,5419,5421,5422,5423,5431,5451,5516,5523,5527,5528,5676,5699,5711,5723,5807,5829</sigids>
      <sig_subsig_ids>3210.0,3210.1,3210.2,3210.3,3211.0,3211.1,3211.2,3211.3,3214.0,3215.0,3220.0,3704.0,5034.0,5048.0,5049.0,5050.0,5051.0,5051.1,5051.2,5052.0,5053.0,5061.0,5070.0,5071.0,5075.0,5085.0,5114.0,5114.1,5114.2,5114.3,5114.4,5114.5,5114.6,5114.7,5114.8,5123.0,5123.1,5123.2,5124.0,5124.1,5124.2,5126.0,5178.0,5200.0,5204.0,5204.1,5246.0,5247.0,5248.0,5258.0,5259.0,5260.0,5263.0,5280.0,5282.0,5282.1,5282.2,5284.0,5311.0,5338.0,5344.0,5364.0,5365.0,5371.0,5372.0,5373.0,5374.0,5374.1,5374.2,5376.0,5405.0,5407.0,5418.0,5419.0,5421.0,5422.0,5423.0,5431.0,5431.1,5451.0,5516.0,5523.0,5527.0,5528.0,5676.0,5699.0,5711.0,5723.0,5807.0,5829.0</sig_subsig_ids>
    </category>
  </category>
  <category name="P2P" cli_name="p2p">
    <category  name="Bittorrent"  cli_name="bittorrent">
      <sigids>11020,11030,11031</sigids>
      <sig_subsig_ids>11020.0,11020.1,11030.0,11031.0</sig_subsig_ids>
    </category>
    <category  name="eDonkey"  cli_name="edonkey">
      <sigids>7202,11018</sigids>
      <sig_subsig_ids>7202.0,11018.0,11018.1</sig_subsig_ids>
    </category>
    <category  name="Kazaa"  cli_name="kazaa">
      <sigids>11000,11005</sigids>
      <sig_subsig_ids>11000.0,11000.1,11000.2,11000.3,11005.0,11005.1,11005.2</sig_subsig_ids>
    </category>
  </category>
  <category name="Email" cli_name="email">
    <category  name="IMAP"  cli_name="imap">
      <sigids>3120,3525,3526,3527,3528,3529,3534,3577,3578,5560,5569,5660,5671,5744,5797,5864,5866,5890,6532</sigids>
      <sig_subsig_ids>3120.1,3525.0,3526.0,3527.0,3527.1,3527.2,3527.3,3527.4,3527.6,3528.0,3529.0,3534.0,3577.0,3578.0,5560.0,5569.0,5660.0,5671.0,5744.0,5797.0,5797.1,5797.2,5797.3,5864.0,5866.0,5890.0,6532.0</sig_subsig_ids>
    </category>
    <category  name="POP"  cli_name="pop">
      <sigids>3135,3550,3551,3728,3729,5447,5448,5449,5450,5549,5562,6253</sigids>
      <sig_subsig_ids>3135.7,3550.0,3551.0,3728.0,3729.0,5447.0,5448.0,5449.0,5450.0,5549.0,5562.0,6253.0</sig_subsig_ids>
    </category>
    <category  name="SMTP"  cli_name="smtp">
      <sigids>3100,3101,3102,3103,3104,3105,3106,3107,3108,3109,3110,3111,3112,3113,3115,3117,3120,3121,3122,3124,3125,3126,3127,3128,3129,3130,3131,3132,3133,3135,3136,3137,3138,3139,3140,3141,3144,3145,3181,4151,5406,5454,5478,5487,5489,5492,5497,5520,5561,5697,5717,5748,5757,5862,6790,6921,12022</sigids>
      <sig_subsig_ids>3100.0,3101.0,3102.0,3103.0,3103.1,3104.0,3104.1,3105.0,3106.0,3107.0,3108.0,3109.0,3110.0,3111.0,3112.0,3113.0,3113.1,3115.0,3115.3,3117.0,3120.0,3121.0,3122.0,3124.0,3125.0,3126.0,3127.0,3128.0,3128.1,3129.0,3130.0,3131.0,3132.0,3132.1,3133.0,3133.1,3135.0,3135.1,3135.2,3135.3,3135.4,3135.5,3135.6,3136.0,3136.1,3136.2,3136.3,3136.4,3136.5,3136.6,3136.7,3136.8,3136.9,3136.10,3136.11,3137.0,3137.1,3137.2,3137.3,3137.4,3137.5,3137.6,3138.0,3139.0,3140.0,3140.1,3140.2,3140.3,3140.4,3140.5,3140.6,3140.7,3140.8,3140.9,3140.10,3140.11,3140.12,3140.13,3140.14,3140.15,3140.16,3140.17,3140.18,3140.19,3141.0,3144.0,3145.0,3145.1,3181.0,4151.0,5406.0,5406.1,5454.0,5478.0,5478.1,5487.0,5489.0,5489.1,5489.2,5489.3,5489.4,5489.5,5489.6,5489.7,5492.0,5497.0,5520.0,5561.0,5561.1,5561.2,5697.0,5717.0,5748.0,5748.1,5748.2,5748.3,5748.4,5748.5,5757.0,5862.0,6790.0,6790.1,6921.0,12022.0</sig_subsig_ids>
    </category>
  </category>
  <category name="IOS IPS" cli_name="ios_ips">
    <category  name="Basic"  cli_name="basic">
      <sigids>1000,1006,1101,1102,1104,1108,1202,1203,1204,1205,1206,1207,1208,2154,2156,2157,3038,3039,3040,3041,3043,3050,3109,3116,3129,3130,3132,3135,3136,3137,3140,3141,3142,3145,3146,3157,3159,3161,3166,3167,3173,3177,3234,3254,3300,3327,3328,3347,3406,3408,3527,3528,3550,3700,3720,3729,3733,3736,3783,3784,3785,3786,3788,3790,3791,4054,4060,4151,4600,4607,4608,4611,4614,4619,4620,5036,5042,5047,5050,5055,5070,5071,5081,5085,5114,5123,5126,5129,5146,5159,5161,5184,5188,5245,5307,5322,5326,5329,5332,5389,5390,5397,5399,5400,5405,5407,5426,5429,5431,5434,5437,5439,5444,5445,5453,5455,5461,5463,5464,5466,5468,5469,5481,5484,5487,5489,5492,5570,5571,5573,5574,5634,5636,5671,5675,5688,5705,5720,5722,5723,5743,5744,5751,5752,5754,5760,5761,5764,5765,5768,5769,5771,5775,5777,5778,5789,6054,6055,6056,6057,6058,6059,6060,6061,6062,6063,6064,6065,6066,6100,6101,6103,6104,6105,6180,6188,6189,6190,6191,6192,6193,6194,6195,6196,6197,6198,6199,6275,6276,6303,6505,6921,11000,11001,11002,11006,11012,11018,11020,11030,11031,11200,11201,11202,11207,11208,11209,11210,11211,11212,11222,11224,11225,12025,12026</sigids>
      <sig_subsig_ids>1000.0,1006.0,1101.0,1102.0,1104.0,1108.0,1202.0,1203.0,1204.0,1205.0,1206.0,1207.0,1208.0,2154.0,2156.0,2157.0,2157.1,2157.2,3038.0,3039.0,3040.0,3041.0,3043.0,3050.0,3109.0,3109.1,3116.0,3129.0,3130.0,3132.0,3132.1,3135.0,3135.1,3135.2,3135.3,3135.4,3135.5,3135.6,3136.0,3136.1,3136.2,3136.3,3136.4,3136.5,3136.6,3136.9,3136.10,3136.11,3137.0,3137.1,3137.2,3137.4,3137.5,3137.6,3140.3,3140.18,3140.19,3141.0,3142.1,3145.0,3145.1,3146.0,3157.0,3159.0,3161.0,3166.0,3167.0,3173.0,3177.0,3234.0,3234.1,3254.0,3254.1,3300.0,3327.0,3327.1,3328.2,3347.1,3406.0,3408.0,3527.0,3527.2,3527.3,3527.4,3527.5,3527.6,3528.0,3550.0,3700.0,3720.0,3729.0,3733.0,3736.0,3783.0,3784.0,3785.0,3786.0,3788.0,3790.0,3791.0,4054.0,4054.1,4060.0,4060.1,4151.0,4151.1,4600.0,4607.0,4607.1,4607.2,4607.3,4607.4,4608.0,4608.1,4608.2,4611.0,4614.0,4614.1,4619.0,4620.0,5036.1,5036.2,5042.1,5042.2,5042.3,5042.4,5042.5,5042.6,5047.0,5050.0,5055.0,5070.0,5071.0,5081.0,5085.0,5114.0,5114.1,5114.2,5123.0,5126.0,5129.0,5146.0,5146.1,5146.2,5146.3,5146.4,5146.5,5146.6,5146.7,5146.8,5146.9,5146.10,5146.11,5146.12,5146.13,5146.14,5146.15,5146.16,5146.17,5159.0,5161.0,5184.0,5188.0,5188.1,5188.2,5188.3,5245.0,5307.0,5322.0,5322.1,5326.0,5329.0,5332.0,5389.0,5390.0,5397.0,5399.0,5400.0,5405.0,5407.0,5426.0,5429.1,5431.0,5431.1,5434.0,5437.0,5439.0,5444.0,5445.0,5453.0,5453.1,5455.0,5455.1,5461.0,5463.0,5463.1,5464.0,5464.1,5466.0,5468.0,5469.0,5469.1,5481.0,5484.0,5487.0,5489.0,5489.1,5489.2,5489.3,5489.4,5489.5,5489.6,5489.7,5492.0,5570.0,5571.0,5573.0,5574.0,5634.0,5636.0,5671.0,5675.0,5688.0,5705.0,5720.0,5722.0,5723.0,5743.0,5744.0,5751.0,5752.0,5754.0,5760.0,5761.0,5764.0,5765.0,5768.0,5769.0,5769.1,5771.0,5775.0,5777.0,5778.0,5789.0,6054.0,6054.1,6055.0,6055.1,6055.2,6056.0,6056.1,6056.2,6057.0,6057.1,6057.2,6058.0,6058.1,6059.0,6059.1,6059.2,6060.0,6060.1,6060.2,6060.3,6061.0,6061.1,6062.0,6062.1,6063.0,6063.1,6064.0,6065.0,6066.0,6100.0,6100.1,6101.0,6101.1,6103.0,6103.1,6104.0,6104.1,6105.0,6105.1,6180.0,6180.1,6188.0,6189.0,6190.0,6190.1,6191.0,6191.1,6192.0,6192.1,6193.0,6193.1,6194.0,6194.1,6195.0,6195.1,6196.0,6196.1,6197.0,6197.1,6198.0,6198.1,6199.0,6199.1,6275.0,6275.1,6276.0,6276.1,6303.0,6505.0,6921.0,11000.0,11000.1,11000.2,11001.0,11002.0,11006.0,11012.0,11018.0,11020.0,11030.0,11031.0,11200.0,11201.0,11202.0,11207.0,11208.0,11209.0,11210.0,11211.0,11212.0,11222.0,11224.0,11225.0,12025.0,12025.1,12026.0</sig_subsig_ids>
    </category>
    <category  name="Advanced"  cli_name="advanced">
      <sigids>1000,1006,1101,1102,1104,1108,1202,1203,1204,1205,1206,1207,1208,2154,2156,2157,3038,3039,3040,3041,3043,3050,3051,3109,3110,3116,3123,3128,3129,3130,3131,3132,3133,3135,3136,3137,3138,3139,3140,3141,3142,3143,3144,3145,3146,3157,3159,3166,3167,3177,3180,3201,3232,3234,3235,3254,3300,3326,3327,3328,3336,3337,3340,3341,3347,3352,3404,3450,3453,3454,3529,3550,3602,3604,3652,3653,3700,3710,3720,3721,3728,3729,3730,3733,3735,3736,3739,3783,3784,3785,3786,3788,3790,3791,3802,3883,3884,4050,4051,4052,4054,4060,4100,4151,4600,4601,4602,4607,4608,4609,4611,4614,4615,4617,4619,4620,4701,4702,5036,5039,5040,5042,5045,5046,5047,5050,5051,5055,5066,5070,5071,5081,5085,5114,5123,5126,5129,5138,5146,5159,5161,5170,5184,5188,5194,5213,5218,5245,5246,5247,5248,5251,5280,5282,5288,5290,5303,5307,5314,5316,5322,5326,5328,5329,5332,5338,5344,5360,5362,5363,5364,5368,5376,5377,5383,5385,5386,5389,5390,5397,5399,5400,5405,5407,5408,5410,5411,5412,5413,5414,5425,5426,5427,5429,5431,5434,5436,5437,5439,5440,5444,5445,5452,5453,5455,5458,5459,5460,5461,5462,5463,5464,5469,5476,5477,5479,5480,5481,5484,5487,5488,5489,5492,5496,5516,5518,5545,5546,5548,5549,5560,5564,5568,5570,5571,5573,5574,5608,5610,5634,5636,5648,5650,5651,5655,5659,5661,5664,5665,5667,5668,5669,5671,5672,5680,5685,5688,5701,5705,5708,5717,5718,5720,5722,5723,5730,5735,5740,5743,5744,5745,5746,5751,5752,5753,5754,5760,5761,5764,5765,5767,5768,5769,5771,5775,5778,5789,6008,6054,6055,6056,6057,6058,6059,6060,6061,6062,6063,6064,6065,6066,6100,6101,6103,6104,6105,6180,6188,6189,6190,6191,6192,6193,6194,6195,6196,6197,6198,6199,6211,6250,6251,6252,6253,6275,6276,6303,6350,6500,6505,6508,6921,9506,11000,11001,11002,11003,11004,11005,11006,11007,11008,11009,11010,11011,11012,11013,11014,11015,11016,11017,11018,11020,11021,11026,11027,11028,11029,11030,11031,11200,11201,11202,11203,11207,11208,11209,11210,11211,11212,11222,11224,11225,11245,12025,12026</sigids>
      <sig_subsig_ids>1000.0,1006.0,1101.0,1102.0,1104.0,1108.0,1202.0,1203.0,1204.0,1205.0,1206.0,1207.0,1208.0,2154.0,2156.0,2157.0,2157.1,2157.2,3038.0,3039.0,3040.0,3041.0,3043.0,3050.0,3051.0,3051.1,3109.0,3109.1,3110.0,3116.0,3123.0,3128.1,3129.0,3130.0,3131.0,3132.0,3132.1,3133.0,3133.1,3135.0,3135.1,3135.2,3135.3,3135.4,3135.5,3135.6,3136.0,3136.1,3136.2,3136.3,3136.4,3136.5,3136.6,3136.7,3136.8,3136.9,3136.10,3136.11,3137.0,3137.1,3137.2,3137.3,3137.4,3137.5,3137.6,3138.0,3139.0,3140.0,3140.1,3140.2,3140.3,3140.4,3140.5,3140.6,3140.7,3140.8,3140.9,3140.10,3140.11,3140.12,3140.13,3140.14,3140.15,3140.16,3140.17,3140.18,3140.19,3141.0,3142.0,3142.1,3143.0,3143.1,3143.2,3144.0,3145.0,3145.1,3146.0,3157.0,3159.0,3166.0,3167.0,3177.0,3180.0,3180.1,3201.1,3201.2,3201.3,3201.4,3201.5,3201.6,3232.0,3234.0,3234.1,3235.0,3235.1,3254.0,3254.1,3300.0,3326.0,3327.0,3328.0,3328.2,3336.0,3337.0,3340.0,3341.0,3347.0,3347.1,3347.2,3352.0,3404.0,3450.0,3453.0,3454.0,3529.0,3550.0,3602.0,3604.0,3652.0,3653.0,3700.0,3710.0,3720.0,3721.0,3728.0,3729.0,3730.0,3730.1,3733.0,3735.0,3736.0,3739.0,3783.0,3784.0,3785.0,3786.0,3788.0,3790.0,3791.0,3802.0,3883.0,3884.0,4050.0,4051.1,4051.2,4051.3,4052.1,4052.2,4054.0,4054.1,4060.0,4060.1,4100.0,4151.0,4151.1,4600.0,4601.0,4601.1,4601.2,4601.3,4602.0,4602.1,4602.2,4607.0,4607.1,4607.2,4607.3,4607.4,4608.0,4608.1,4608.2,4609.0,4611.0,4614.0,4614.1,4615.0,4615.1,4617.1,4619.0,4620.0,4701.0,4702.0,5036.1,5036.2,5039.0,5040.1,5040.2,5040.3,5042.1,5042.2,5042.3,5042.4,5042.5,5042.6,5045.0,5046.0,5047.0,5050.0,5051.0,5051.1,5051.2,5055.0,5066.0,5070.0,5071.0,5081.0,5085.0,5114.0,5114.1,5114.2,5114.3,5114.4,5114.5,5114.6,5114.7,5114.8,5123.0,5123.1,5123.2,5126.0,5129.0,5138.0,5146.0,5146.1,5146.2,5146.3,5146.4,5146.5,5146.6,5146.7,5146.8,5146.9,5146.10,5146.11,5146.12,5146.13,5146.14,5146.15,5146.16,5146.17,5159.0,5161.0,5170.0,5184.0,5188.0,5188.1,5188.2,5188.3,5194.0,5194.1,5194.2,5213.0,5218.0,5245.0,5246.0,5247.0,5248.0,5251.0,5280.0,5282.0,5282.1,5282.2,5288.0,5290.0,5303.0,5307.0,5314.0,5316.0,5322.0,5322.1,5326.0,5328.0,5328.1,5329.0,5332.0,5338.0,5344.0,5360.0,5362.0,5363.0,5364.0,5368.0,5376.0,5377.0,5383.0,5383.1,5383.2,5385.0,5386.0,5389.0,5390.0,5397.0,5399.0,5400.0,5405.0,5407.0,5408.0,5408.1,5410.0,5411.0,5412.0,5413.0,5414.0,5425.0,5426.0,5427.0,5429.1,5431.0,5431.1,5434.1,5436.0,5436.1,5437.0,5439.0,5440.0,5444.0,5445.0,5452.0,5453.0,5453.1,5455.0,5455.1,5458.0,5459.0,5459.1,5460.0,5461.0,5462.0,5463.0,5463.1,5464.0,5464.1,5464.2,5469.0,5469.1,5476.0,5477.0,5477.1,5477.2,5479.0,5480.0,5481.0,5484.0,5487.0,5488.0,5489.0,5489.1,5489.2,5489.3,5489.4,5489.5,5489.6,5489.7,5492.0,5496.0,5516.0,5518.0,5545.0,5545.1,5546.0,5548.0,5549.0,5560.0,5564.0,5568.0,5570.0,5571.0,5573.0,5574.0,5608.0,5610.0,5634.0,5636.0,5648.1,5650.0,5651.0,5651.1,5655.0,5659.0,5661.0,5664.0,5665.0,5667.0,5668.0,5669.0,5671.0,5672.0,5680.0,5685.0,5688.0,5701.0,5701.1,5705.0,5708.0,5717.0,5718.0,5720.0,5722.0,5723.0,5730.0,5735.0,5740.0,5743.0,5744.0,5745.0,5746.0,5751.0,5752.0,5753.0,5754.0,5760.0,5761.0,5764.0,5765.0,5767.0,5768.0,5769.0,5769.1,5771.0,5775.0,5778.0,5789.0,6008.0,6054.0,6054.1,6055.0,6055.1,6055.2,6056.0,6056.1,6056.2,6057.0,6057.1,6057.2,6058.0,6058.1,6059.0,6059.1,6059.2,6060.0,6060.1,6060.2,6060.3,6061.0,6061.1,6062.0,6062.1,6063.0,6063.1,6064.0,6065.0,6066.0,6100.0,6100.1,6101.0,6101.1,6103.0,6103.1,6104.0,6104.1,6105.0,6105.1,6180.0,6180.1,6188.0,6189.0,6190.0,6190.1,6191.0,6191.1,6192.0,6192.1,6193.0,6193.1,6194.0,6194.1,6195.0,6195.1,6196.0,6196.1,6197.0,6197.1,6198.0,6198.1,6199.0,6199.1,6211.0,6250.0,6251.0,6252.0,6253.0,6275.0,6275.1,6276.0,6276.1,6303.0,6350.0,6500.0,6500.1,6505.0,6508.0,6508.1,6921.0,9506.0,11000.0,11000.1,11000.2,11001.0,11002.0,11003.0,11004.0,11005.0,11005.1,11006.0,11007.0,11008.0,11009.0,11010.0,11011.0,11012.0,11013.0,11014.0,11015.0,11016.0,11017.0,11018.0,11020.0,11021.0,11026.0,11027.0,11028.0,11029.0,11030.0,11031.0,11200.0,11201.0,11202.0,11203.0,11207.0,11208.0,11209.0,11210.0,11211.0,11212.0,11222.0,11224.0,11225.0,11245.0,11245.1,12025.0,12025.1,12026.0</sig_subsig_ids>
    </category>
  </category>
  <category name="UC Protection" cli_name="uc_protection">
    <category  name="Cisco UC Protection"  cli_name="cisco_uc_protection">
      <sigids>3116,3119,3128,3132,3133,3134,3135,3136,3137,3138,3140,3141,3142,3144,3145,3146,3172,3177,3178,3234,3300,3310,3314,3324,3327,3329,3330,3331,3332,3335,3338,3342,3347,3719,3720,4607,4612,4703,5081,5123,5326,5328,5368,5376,5377,5389,5400,5405,5413,5414,5429,5431,5434,5435,5438,5463,5469,5478,5484,5487,5489,5492,5525,5547,5548,5556,5582,5586,5588,5592,5593,5598,5599,5601,5684,5699,5713,5717,5718,5766,5776,5792,5799,5821,5825,5835,5839,5843,5848,5849,5853,5854,5858,5870,5871,5876,5878,5889,5893,5894,5906,5908,5910,5912,5915,5918,5928,6012,6030,6131,6184,6186,6187,6224,6229,6262,6264,6265,6266,6278,6403,6406,6408,6409,6410,6515,6517,6518,6520,6521,6522,6523,6527,6533,6540,6760,6761,6765,6771,6775,6776,6777,6778,6781,6782,6784,6786,6921,6924,6929,6930,6936,6937,6954</sigids>
      <sig_subsig_ids>3116.0,3119.0,3128.0,3132.0,3132.1,3133.0,3133.1,3134.0,3135.0,3135.1,3135.2,3135.3,3135.4,3135.5,3135.6,3136.0,3136.1,3136.2,3136.3,3136.8,3136.9,3137.0,3137.1,3137.2,3137.3,3137.4,3137.5,3138.0,3140.0,3140.1,3140.2,3140.5,3140.6,3140.7,3140.8,3140.9,3140.10,3140.11,3140.12,3140.13,3140.14,3140.15,3140.16,3140.17,3140.18,3140.19,3141.0,3142.0,3142.1,3144.0,3145.0,3145.1,3146.0,3172.0,3177.0,3178.0,3234.0,3234.1,3300.0,3310.0,3314.2,3324.0,3327.11,3327.12,3329.0,3330.0,3331.2,3331.3,3332.0,3335.0,3338.0,3342.0,3342.1,3347.2,3719.0,3720.0,4607.5,4612.0,4612.1,4703.0,5081.0,5123.2,5326.0,5328.0,5328.1,5368.0,5376.0,5377.0,5389.0,5400.0,5405.0,5413.0,5414.0,5429.0,5429.1,5431.0,5431.1,5434.0,5434.1,5435.0,5438.0,5463.0,5463.1,5469.0,5469.1,5478.0,5478.1,5484.0,5487.0,5489.0,5489.1,5489.3,5489.4,5489.5,5489.6,5492.0,5525.0,5547.0,5548.0,5556.1,5556.3,5556.4,5582.0,5586.0,5588.0,5592.0,5593.0,5598.0,5598.1,5599.0,5601.0,5684.0,5684.1,5684.2,5684.4,5684.6,5699.0,5713.0,5717.0,5718.0,5766.0,5776.0,5776.4,5792.0,5799.4,5799.7,5821.0,5825.0,5835.0,5835.1,5835.2,5835.3,5835.4,5835.5,5835.6,5835.7,5839.0,5843.0,5848.0,5849.0,5853.0,5854.0,5854.1,5858.0,5858.1,5858.4,5870.0,5871.0,5876.0,5878.0,5889.0,5893.0,5893.1,5893.2,5894.1,5906.0,5908.0,5910.0,5912.0,5915.0,5918.0,5928.0,6012.0,6030.0,6131.7,6184.0,6186.0,6187.0,6224.0,6229.0,6262.0,6264.0,6265.0,6266.0,6278.0,6403.0,6406.0,6408.0,6409.0,6410.0,6515.0,6517.0,6518.0,6518.1,6520.0,6521.0,6522.0,6523.0,6527.0,6533.0,6540.0,6760.0,6761.0,6765.0,6771.0,6775.0,6775.1,6776.0,6777.0,6778.0,6781.0,6782.0,6784.0,6784.1,6784.2,6784.3,6786.0,6921.0,6924.0,6929.0,6930.0,6936.0,6936.1,6937.0,6954.0,6954.1</sig_subsig_ids>
    </category>
  </category>
    <category name="Releases" cli_name="releases">
      <category name="Past Releases" cli_name="past_releases">
        <sigids>1000,1001,1002,1003,1004,1005,1006,1007,1101,1102,1104,1107,1108,1109,1200,1201,1202,1203,1204,1205,1206,1207,1208,1220,1225,1250,1300,1301,1302,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1330,1600,1601,1602,1603,1604,1605,1606,1607,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2100,2101,2102,2150,2151,2152,2153,2154,2155,2156,2157,2158,2200,2201,2202,3001,3002,3003,3005,3006,3010,3011,3012,3015,3016,3020,3021,3030,3031,3032,3033,3034,3035,3036,3037,3038,3039,3040,3041,3042,3043,3045,3046,3050,3051,3052,3100,3101,3102,3103,3104,3105,3106,3107,3108,3109,3110,3111,3112,3113,3114,3115,3116,3117,3118,3119,3120,3121,3122,3123,3124,3125,3126,3127,3128,3129,3130,3131,3132,3133,3134,3135,3136,3137,3138,3139,3140,3141,3142,3143,3144,3145,3146,3150,3151,3152,3153,3154,3155,3156,3157,3158,3159,3160,3161,3162,3163,3164,3165,3166,3167,3168,3169,3170,3171,3172,3173,3175,3177,3178,3179,3180,3181,3200,3201,3202,3203,3204,3205,3206,3207,3208,3209,3210,3211,3212,3213,3214,3215,3216,3217,3218,3219,3220,3221,3222,3223,3224,3225,3226,3227,3228,3229,3230,3231,3232,3233,3234,3235,3236,3250,3251,3252,3253,3254,3255,3300,3301,3302,3303,3304,3305,3306,3307,3308,3309,3310,3311,3312,3313,3314,3315,3316,3317,3318,3319,3320,3321,3322,3323,3324,3325,3326,3327,3328,3329,3330,3331,3332,3333,3334,3335,3336,3337,3338,3339,3340,3341,3342,3343,3344,3345,3346,3347,3348,3349,3350,3351,3352,3353,3356,3357,3400,3401,3402,3403,3404,3405,3406,3407,3408,3409,3450,3451,3452,3453,3454,3455,3456,3457,3458,3459,3461,3462,3463,3464,3465,3466,3500,3501,3502,3525,3526,3527,3528,3529,3530,3531,3532,3533,3534,3537,3540,3550,3551,3575,3576,3577,3578,3600,3601,3602,3603,3604,3650,3651,3652,3653,3654,3700,3701,3702,3703,3704,3705,3706,3707,3708,3709,3710,3711,3714,3716,3718,3719,3720,3721,3728,3729,3730,3731,3732,3733,3734,3735,3736,3737,3738,3739,3740,3782,3783,3784,3785,3786,3787,3788,3789,3790,3791,3792,3793,3802,3883,3884,3990,3991,3992,4001,4002,4003,4050,4051,4052,4053,4054,4055,4056,4058,4060,4061,4062,4063,4067,4068,4100,4101,4150,4151,4500,4501,4502,4503,4504,4505,4506,4507,4508,4509,4510,4511,4512,4513,4514,4515,4516,4600,4601,4602,4603,4604,4605,4606,4607,4608,4609,4610,4611,4612,4613,4614,4615,4617,4619,4620,4701,4702,4703,4704,5034,5035,5036,5037,5038,5039,5040,5041,5042,5043,5044,5045,5046,5047,5048,5049,5050,5051,5052,5053,5054,5055,5056,5057,5058,5059,5060,5061,5062,5063,5064,5065,5066,5067,5068,5069,5070,5071,5072,5073,5074,5075,5076,5077,5078,5079,5080,5081,5083,5084,5085,5086,5087,5088,5089,5090,5091,5092,5093,5095,5096,5097,5099,5100,5101,5102,5103,5104,5105,5106,5107,5108,5109,5110,5111,5112,5113,5114,5115,5116,5117,5118,5119,5120,5121,5122,5123,5124,5125,5126,5127,5128,5129,5130,5131,5132,5133,5134,5138,5140,5141,5142,5146,5147,5148,5149,5150,5151,5152,5154,5155,5156,5157,5158,5159,5160,5161,5162,5163,5164,5165,5166,5167,5168,5169,5170,5171,5172,5173,5174,5175,5176,5177,5178,5179,5180,5181,5182,5183,5184,5188,5191,5194,5195,5196,5197,5199,5200,5201,5202,5203,5204,5205,5206,5207,5208,5209,5210,5211,5212,5213,5214,5215,5216,5217,5218,5219,5220,5221,5222,5223,5224,5229,5230,5231,5232,5233,5234,5235,5236,5237,5238,5239,5240,5241,5243,5244,5245,5246,5247,5248,5251,5252,5253,5255,5256,5257,5258,5259,5260,5261,5262,5263,5265,5266,5268,5269,5270,5271,5272,5273,5274,5275,5276,5277,5278,5279,5280,5281,5282,5283,5284,5285,5286,5287,5288,5289,5290,5291,5292,5293,5294,5295,5296,5297,5298,5299,5300,5301,5302,5303,5304,5305,5306,5307,5308,5309,5310,5311,5312,5313,5314,5315,5316,5317,5318,5319,5320,5321,5322,5323,5324,5325,5326,5327,5328,5329,5330,5331,5332,5333,5334,5335,5336,5337,5338,5339,5340,5341,5342,5343,5344,5345,5346,5347,5348,5349,5350,5351,5352,5353,5354,5355,5356,5357,5358,5359,5360,5362,5363,5364,5365,5366,5367,5368,5369,5370,5371,5372,5373,5374,5375,5376,5377,5378,5379,5380,5381,5382,5383,5385,5386,5388,5389,5390,5391,5392,5393,5394,5395,5397,5399,5400,5401,5402,5403,5405,5406,5407,5408,5409,5410,5411,5412,5413,5414,5416,5417,5418,5419,5420,5421,5422,5423,5424,5425,5426,5427,5428,5429,5430,5431,5432,5433,5434,5435,5436,5437,5438,5439,5440,5441,5442,5443,5444,5445,5446,5447,5448,5449,5450,5451,5452,5453,5454,5455,5456,5457,5458,5459,5460,5461,5462,5463,5464,5465,5466,5467,5468,5469,5471,5472,5473,5474,5475,5476,5477,5478,5479,5480,5481,5482,5483,5484,5485,5486,5487,5488,5489,5490,5491,5492,5493,5494,5495,5496,5497,5498,5499,5500,5501,5502,5503,5504,5505,5506,5507,5508,5509,5510,5511,5512,5513,5514,5515,5516,5517,5518,5519,5520,5521,5523,5524,5525,5526,5527,5528,5529,5530,5531,5532,5533,5534,5535,5536,5537,5538,5539,5540,5541,5543,5544,5545,5546,5547,5548,5549,5551,5552,5553,5554,5555,5556,5557,5558,5559,5560,5561,5562,5564,5565,5566,5567,5568,5569,5570,5571,5572,5573,5574,5575,5576,5577,5578,5579,5580,5581,5582,5583,5584,5585,5586,5587,5588,5589,5590,5591,5592,5593,5594,5595,5596,5597,5598,5599,5600,5601,5602,5603,5605,5606,5608,5609,5610,5611,5612,5613,5614,5615,5616,5617,5618,5619,5620,5621,5622,5623,5624,5625,5626,5627,5628,5629,5630,5631,5632,5633,5634,5635,5636,5637,5638,5639,5641,5642,5643,5644,5645,5646,5647,5648,5649,5650,5651,5652,5653,5654,5655,5656,5657,5658,5659,5660,5661,5662,5663,5664,5665,5666,5667,5668,5669,5671,5672,5673,5674,5675,5676,5677,5678,5679,5680,5681,5683,5684,5685,5686,5687,5688,5689,5692,5693,5694,5695,5696,5697,5698,5699,5700,5701,5703,5705,5706,5708,5710,5711,5713,5714,5715,5716,5717,5718,5720,5722,5723,5724,5725,5726,5727,5728,5729,5730,5731,5732,5733,5734,5735,5736,5737,5738,5739,5740,5743,5744,5745,5746,5747,5748,5749,5750,5751,5752,5753,5754,5756,5757,5758,5759,5760,5761,5763,5764,5765,5766,5767,5768,5769,5770,5771,5772,5773,5774,5775,5776,5777,5778,5779,5780,5781,5782,5783,5784,5785,5786,5787,5788,5789,5790,5792,5793,5794,5795,5796,5797,5798,5799,5800,5801,5802,5803,5804,5805,5806,5807,5809,5810,5812,5813,5814,5815,5816,5817,5818,5819,5820,5821,5822,5823,5824,5825,5826,5827,5828,5829,5830,5831,5832,5833,5835,5837,5838,5839,5840,5841,5842,5843,5845,5846,5847,5848,5849,5850,5851,5852,5853,5854,5855,5856,5857,5858,5860,5861,5862,5863,5864,5865,5866,5868,5869,5870,5871,5873,5874,5876,5877,5878,5880,5884,5885,5887,5888,5889,5890,5892,5893,5894,5898,5899,5902,5903,5905,5906,5908,5909,5910,5912,5913,5915,5916,5918,5919,5920,5921,5928,5985,6003,6004,6005,6007,6008,6009,6011,6012,6013,6017,6030,6050,6051,6052,6053,6054,6055,6056,6057,6058,6059,6060,6061,6062,6063,6064,6065,6066,6067,6068,6069,6100,6101,6102,6103,6104,6105,6110,6111,6112,6113,6114,6115,6116,6117,6118,6120,6121,6122,6123,6124,6125,6126,6127,6128,6130,6131,6150,6151,6152,6153,6154,6155,6171,6175,6180,6188,6189,6190,6191,6192,6193,6194,6195,6196,6197,6198,6199,6200,6201,6202,6203,6210,6211,6224,6228,6229,6232,6235,6236,6242,6246,6249,6250,6251,6252,6253,6255,6256,6257,6258,6259,6260,6261,6262,6263,6264,6265,6266,6269,6270,6271,6272,6273,6274,6275,6276,6277,6278,6299,6300,6302,6303,6350,6403,6406,6408,6409,6410,6412,6449,6500,6501,6502,6503,6504,6505,6506,6507,6508,6509,6510,6512,6513,6526,6527,6528,6530,6532,6533,6534,6535,6536,6537,6539,6540,6541,6543,6544,6545,6546,6755,6760,6764,6765,6767,6768,6769,6771,6773,6775,6776,6777,6778,6780,6781,6782,6784,6785,6786,6787,6788,6793,6794,6901,6902,6903,6910,6920,6921,6922,6923,6924,6925,6926,6928,6929,6930,6931,6934,6935,6936,6937,6939,6940,6942,6944,6951,6952,6954,6959,6960,6961,6963,7000,7001,7101,7102,7104,7105,7201,7202,7203,7205,9000,9001,9002,9003,9004,9005,9006,9007,9008,9009,9010,9011,9012,9013,9014,9015,9016,9017,9018,9019,9020,9021,9022,9023,9024,9025,9026,9027,9028,9029,9030,9031,9032,9033,9036,9037,9038,9039,9040,9041,9042,9043,9044,9045,9200,9201,9202,9203,9204,9205,9206,9207,9208,9209,9210,9211,9212,9213,9214,9215,9216,9217,9218,9223,9224,9225,9226,9227,9228,9229,9230,9231,9232,9233,9236,9237,9238,9239,9240,9241,9242,9243,9244,9245,9400,9401,9402,9403,9404,9405,9406,9407,9408,9409,9410,9411,9412,9413,9414,9415,9416,9417,9418,9419,9420,9421,9422,9423,9424,9425,9426,9427,9428,9429,9430,9431,9432,9433,9434,9435,9436,9437,9438,9439,9440,9441,9442,9443,9444,9445,9446,9447,9449,9450,9451,9452,9453,9454,9455,9456,9457,9458,9459,9460,9461,9462,9463,9464,9465,9466,9467,9468,9469,9470,9471,9472,9473,9474,9475,9476,9477,9478,9479,9480,9481,9482,9483,9484,9485,9486,9487,9488,9489,9490,9491,9492,9493,9494,9495,9496,9497,9498,9499,9500,9501,9502,9503,9504,9505,9506,9507,9508,9509,9510,9511,9512,9513,9514,9515,9516,9517,9518,9519,9520,9521,9522,9523,9524,9525,9527,9528,9529,9530,9531,9532,9533,9534,9535,9536,9537,9538,9539,9540,9541,9542,9543,9544,9545,9546,9547,9548,9549,9550,9551,9552,9553,9554,9555,9556,9557,9558,9559,9560,9561,9562,9563,9564,9565,9566,9567,9568,9570,9571,9572,9573,9574,9575,9576,9577,9578,9579,9580,9581,9582,9583,11000,11001,11002,11003,11004,11005,11006,11007,11008,11009,11010,11011,11012,11013,11014,11015,11016,11017,11018,11019,11020,11021,11022,11023,11024,11025,11026,11027,11028,11029,11030,11031,11200,11201,11202,11203,11204,11205,11206,11207,11208,11209,11210,11211,11212,11213,11214,11215,11216,11217,11218,11219,11221,11222,11223,11224,11225,11226,11227,11228,11229,11230,11231,11232,11233,11234,11235,11236,11237,11238,11239,11240,11241,11242,11244,11245,11246,11247,11248,11249,11250,11251,11252,12000,12001,12002,12003,12004,12005,12006,12007,12008,12009,12010,12011,12012,12013,12014,12015,12016,12017,12018,12019,12020,12021,12022,12023,12024,12025,12026,12027,12500,12501,12502,12503,12505,12621,12622,12623,12624,12626,12627,12628,12629,12631,12633,12634,12635,12636,12637,12638,12639,12641,12642,12643,12644,12645,12646,12648,12649,12650,12651,12652,12653,12654,12655,12656,12658,12659,12660,12661,12662,12663,12664,12665,12666,12667,12668,12669,12673,12674,12675,12676,12677,12678,12679,12680,12681,12682,12683,12685,12686,12687,12688,12689,12690,12693,12694,12695,12696,12697,12698,12699,12700,12701,12702,12703,12704,12705,12706,12707,12708,12709,12710,12711,12712,12713,12900,12901,12902,12903,12904,12905,12906,12907,12908,12909,12910,12911,12912,12913,12914,12915,12916,12917,12918,12919,12920,12921,12922,12923,12924,12925,12926,12927,12928,12929,12930,12931,12932,12933,13000,13001,13002,13003,13004,13005,13006,13007,13008,50000</sigids>
        <sig_subsig_ids>1000.0,1001.0,1002.0,1003.0,1004.0,1005.0,1006.0,1007.0,1101.0,1102.0,1104.0,1107.0,1108.0,1109.0,1109.1,1109.2,1109.3,1200.0,1201.0,1202.0,1203.0,1204.0,1205.0,1206.0,1207.0,1208.0,1220.0,1225.0,1250.0,1300.0,1301.0,1302.0,1303.0,1304.0,1305.0,1306.0,1306.1,1306.2,1306.3,1306.4,1306.5,1306.6,1307.0,1308.0,1309.0,1310.0,1311.0,1312.0,1313.0,1314.0,1315.0,1316.0,1330.0,1330.1,1330.2,1330.3,1330.4,1330.5,1330.6,1330.7,1330.8,1330.9,1330.10,1330.11,1330.12,1330.13,1330.14,1330.15,1330.16,1330.17,1330.18,1330.19,1330.20,1330.21,1600.0,1601.0,1602.0,1603.0,1604.0,1605.0,1606.0,1607.0,2000.0,2001.0,2001.1,2002.0,2003.0,2004.0,2005.0,2006.0,2007.0,2008.0,2009.0,2010.0,2011.0,2012.0,2100.0,2101.0,2102.0,2150.0,2151.0,2152.0,2153.0,2154.0,2155.0,2156.0,2157.0,2157.1,2157.2,2158.0,2200.0,2201.0,2202.0,3001.0,3002.0,3003.0,3005.0,3006.0,3010.0,3011.0,3012.0,3015.0,3016.0,3020.0,3021.0,3030.0,3031.0,3032.0,3033.0,3034.0,3035.0,3036.0,3037.0,3038.0,3039.0,3040.0,3041.0,3042.0,3043.0,3045.0,3046.0,3050.0,3051.0,3051.1,3052.0,3100.0,3101.0,3102.0,3103.0,3103.1,3104.0,3104.1,3105.0,3106.0,3107.0,3108.0,3109.0,3109.1,3110.0,3111.0,3111.1,3112.0,3113.0,3113.1,3114.0,3115.0,3115.3,3116.0,3117.0,3117.1,3118.0,3119.0,3120.0,3120.1,3121.0,3122.0,3123.0,3124.0,3125.0,3126.0,3127.0,3128.0,3128.1,3129.0,3130.0,3131.0,3132.0,3132.1,3133.0,3133.1,3134.0,3135.0,3135.1,3135.2,3135.3,3135.4,3135.5,3135.6,3135.7,3136.0,3136.1,3136.2,3136.3,3136.4,3136.5,3136.6,3136.7,3136.8,3136.9,3136.10,3136.11,3137.0,3137.1,3137.2,3137.3,3137.4,3137.5,3137.6,3138.0,3139.0,3140.0,3140.1,3140.2,3140.3,3140.4,3140.5,3140.6,3140.7,3140.8,3140.9,3140.10,3140.11,3140.12,3140.13,3140.14,3140.15,3140.16,3140.17,3140.18,3140.19,3141.0,3142.0,3142.1,3142.3,3143.0,3143.1,3143.2,3143.3,3143.4,3144.0,3145.0,3145.1,3146.0,3150.0,3150.1,3151.0,3152.0,3153.0,3154.0,3155.0,3156.0,3157.0,3158.0,3159.0,3160.0,3161.0,3161.1,3162.0,3163.0,3164.0,3165.0,3166.0,3167.0,3168.0,3169.0,3170.0,3171.0,3171.1,3172.0,3173.0,3175.0,3177.0,3178.0,3179.0,3180.0,3180.1,3181.0,3200.0,3201.1,3201.2,3201.3,3201.4,3201.5,3201.6,3202.0,3203.0,3204.0,3205.0,3206.0,3207.0,3208.0,3209.0,3210.0,3210.1,3210.2,3210.3,3211.0,3211.1,3211.2,3211.3,3212.0,3213.0,3214.0,3215.0,3216.0,3217.0,3218.0,3219.0,3220.0,3221.0,3222.0,3223.0,3224.0,3225.0,3226.0,3227.0,3228.0,3229.0,3230.0,3231.0,3232.0,3233.0,3234.0,3234.1,3235.0,3235.1,3236.0,3250.0,3251.0,3252.0,3253.0,3254.0,3254.1,3255.0,3300.0,3301.0,3302.0,3303.0,3304.0,3305.0,3306.0,3307.0,3308.0,3309.0,3310.0,3311.0,3312.0,3313.0,3314.0,3314.1,3314.2,3315.0,3316.0,3317.0,3318.0,3319.0,3320.0,3321.0,3322.0,3323.0,3324.0,3325.0,3326.0,3327.0,3327.1,3327.2,3327.3,3327.4,3327.5,3327.6,3327.7,3327.8,3327.9,3327.10,3327.11,3327.12,3327.13,3328.0,3328.1,3328.2,3328.3,3329.0,3330.0,3331.0,3331.1,3331.2,3331.3,3331.4,3332.0,3333.0,3334.0,3334.1,3334.2,3334.3,3334.4,3334.5,3334.6,3334.7,3334.8,3335.0,3336.0,3337.0,3338.0,3338.1,3338.2,3338.3,3339.0,3340.0,3341.0,3342.0,3342.1,3343.0,3344.0,3345.0,3346.0,3347.0,3347.1,3347.2,3348.0,3349.0,3350.0,3351.0,3352.0,3353.0,3353.1,3353.2,3356.0,3357.0,3400.0,3401.0,3401.1,3402.0,3402.1,3402.2,3402.3,3402.4,3403.0,3404.0,3404.1,3405.0,3406.0,3407.0,3408.0,3409.0,3409.1,3409.2,3450.0,3451.0,3452.0,3453.0,3454.0,3455.0,3456.0,3456.1,3456.3,3457.0,3458.0,3459.0,3459.1,3461.0,3462.0,3463.0,3464.0,3465.0,3466.0,3500.0,3501.0,3502.0,3525.0,3526.0,3527.0,3527.1,3527.2,3527.3,3527.4,3527.5,3527.6,3528.0,3529.0,3530.0,3531.0,3532.0,3533.0,3534.0,3537.0,3540.0,3550.0,3551.0,3575.0,3576.0,3577.0,3578.0,3600.0,3601.0,3602.0,3603.0,3604.0,3650.0,3651.0,3652.0,3653.0,3654.0,3700.0,3701.0,3702.0,3703.0,3704.0,3705.0,3706.0,3707.0,3708.0,3709.0,3710.0,3711.0,3714.0,3716.0,3716.1,3718.0,3719.0,3720.0,3721.0,3728.0,3729.0,3730.0,3730.1,3731.0,3732.0,3733.0,3734.0,3735.0,3736.0,3737.0,3738.0,3739.0,3740.0,3782.0,3783.0,3784.0,3785.0,3786.0,3787.0,3788.0,3789.0,3790.0,3791.0,3792.0,3793.0,3802.0,3883.0,3884.0,3990.1,3990.2,3991.0,3992.1,3992.2,3992.3,3992.4,3992.5,4001.0,4002.0,4003.0,4050.0,4051.1,4051.2,4051.3,4052.1,4052.2,4053.0,4054.0,4054.1,4055.1,4055.2,4056.0,4058.0,4058.1,4058.2,4060.0,4060.1,4061.0,4062.0,4063.0,4067.0,4068.0,4100.0,4101.0,4150.0,4151.0,4151.1,4500.0,4500.1,4501.0,4502.0,4503.0,4503.1,4504.0,4505.0,4506.0,4507.0,4507.1,4507.2,4507.3,4507.4,4507.5,4507.6,4507.7,4507.8,4507.9,4507.10,4507.11,4507.12,4507.13,4507.14,4507.15,4507.16,4507.17,4507.18,4507.19,4507.20,4507.21,4507.22,4507.23,4507.24,4507.25,4507.26,4507.27,4507.28,4507.29,4507.30,4507.31,4507.32,4507.33,4507.34,4507.35,4507.36,4507.37,4508.0,4509.0,4510.0,4511.0,4512.0,4513.0,4514.0,4515.0,4515.1,4516.0,4600.0,4601.0,4601.1,4601.2,4601.3,4602.0,4602.1,4602.2,4602.3,4602.4,4603.0,4604.0,4604.1,4605.0,4605.1,4606.0,4606.1,4607.0,4607.1,4607.2,4607.3,4607.4,4607.5,4607.6,4607.7,4607.8,4607.9,4608.0,4608.1,4608.2,4608.3,4608.4,4608.5,4609.0,4609.1,4610.0,4610.1,4611.0,4611.1,4612.0,4612.1,4613.0,4613.1,4614.0,4614.1,4615.0,4615.1,4615.2,4615.3,4617.0,4617.1,4619.0,4620.0,4701.0,4702.0,4703.0,4704.0,5034.0,5035.0,5036.1,5036.2,5037.0,5038.0,5039.0,5040.1,5040.2,5040.3,5041.0,5042.1,5042.2,5042.3,5042.4,5042.5,5042.6,5043.1,5043.2,5043.3,5044.0,5045.0,5046.0,5047.0,5048.0,5049.0,5050.0,5051.0,5051.1,5051.2,5052.0,5053.0,5054.0,5055.0,5056.0,5057.0,5057.1,5058.0,5059.0,5059.1,5059.2,5060.0,5061.0,5062.0,5063.0,5064.0,5065.0,5066.0,5067.0,5068.0,5069.0,5070.0,5071.0,5072.0,5073.0,5074.0,5075.0,5076.0,5077.0,5078.0,5079.0,5080.0,5081.0,5083.0,5084.0,5084.1,5085.0,5086.0,5087.0,5087.1,5088.0,5089.0,5090.0,5091.0,5091.1,5092.0,5093.0,5095.0,5096.0,5097.0,5097.1,5097.2,5099.0,5100.0,5101.0,5102.0,5103.0,5104.0,5105.0,5106.0,5107.0,5108.0,5108.1,5108.2,5109.0,5109.1,5110.0,5111.0,5112.0,5113.0,5114.0,5114.1,5114.2,5114.3,5114.4,5114.5,5114.6,5114.7,5114.8,5115.0,5115.1,5115.2,5115.3,5115.4,5115.5,5115.6,5116.0,5117.0,5118.0,5119.0,5120.0,5121.0,5122.0,5123.0,5123.1,5123.2,5124.0,5124.1,5124.2,5125.0,5126.0,5127.0,5128.0,5129.0,5130.0,5131.0,5132.0,5133.0,5134.0,5138.0,5140.0,5141.0,5142.0,5142.1,5146.0,5146.1,5146.2,5146.3,5146.4,5146.5,5146.6,5146.7,5146.8,5146.9,5146.10,5146.11,5146.12,5146.13,5146.14,5146.15,5146.16,5146.17,5147.0,5148.0,5149.0,5150.0,5151.0,5152.0,5154.0,5155.0,5156.0,5157.0,5158.0,5159.0,5160.0,5161.0,5162.0,5163.0,5164.0,5165.0,5166.0,5167.0,5168.0,5169.0,5170.0,5170.1,5171.0,5172.0,5173.0,5174.0,5175.0,5176.0,5177.0,5177.1,5178.0,5179.0,5180.0,5181.0,5181.1,5182.0,5183.0,5184.0,5188.0,5188.1,5188.2,5188.3,5191.0,5194.0,5194.1,5194.2,5195.0,5196.0,5196.1,5197.0,5199.0,5200.0,5201.0,5201.1,5201.2,5202.0,5202.1,5203.0,5204.0,5204.1,5205.0,5206.0,5207.0,5207.1,5208.0,5209.0,5210.0,5210.1,5211.0,5212.0,5213.0,5214.0,5215.0,5215.1,5216.0,5216.1,5217.0,5218.0,5219.0,5220.0,5221.0,5221.1,5221.2,5221.3,5221.4,5222.0,5223.0,5224.0,5229.0,5230.0,5231.0,5232.0,5232.1,5233.0,5234.0,5234.1,5235.0,5236.0,5237.0,5238.0,5239.0,5240.0,5241.0,5243.0,5243.1,5243.2,5243.3,5243.4,5243.5,5243.6,5244.0,5245.0,5246.0,5247.0,5248.0,5251.0,5252.0,5253.0,5255.0,5256.0,5257.0,5258.0,5259.0,5260.0,5261.0,5262.0,5263.0,5265.0,5266.0,5268.0,5269.0,5270.0,5271.0,5272.0,5273.0,5273.1,5273.2,5273.3,5274.0,5274.1,5275.0,5275.1,5276.0,5276.1,5276.2,5277.0,5278.0,5279.0,5280.0,5281.0,5282.0,5282.1,5282.2,5283.0,5284.0,5285.0,5286.0,5287.0,5288.0,5289.0,5290.0,5291.0,5292.0,5293.0,5294.0,5295.0,5296.0,5297.0,5298.0,5299.0,5300.0,5301.0,5302.0,5303.0,5304.0,5305.0,5305.1,5305.2,5305.3,5306.0,5307.0,5308.0,5309.0,5310.0,5311.0,5312.0,5313.0,5314.0,5315.0,5316.0,5317.0,5318.0,5319.0,5320.0,5321.0,5322.0,5322.1,5323.0,5324.0,5325.0,5326.0,5327.0,5328.0,5328.1,5329.0,5330.0,5331.0,5332.0,5333.0,5333.1,5334.0,5335.0,5336.0,5337.0,5338.0,5339.0,5340.0,5341.0,5342.0,5343.0,5344.0,5345.0,5346.0,5347.0,5348.0,5349.0,5350.0,5351.0,5352.0,5353.0,5354.0,5355.0,5356.0,5357.0,5358.0,5359.0,5360.0,5362.0,5363.0,5364.0,5365.0,5366.0,5366.1,5367.0,5368.0,5369.0,5370.0,5371.0,5372.0,5373.0,5374.0,5374.1,5374.2,5375.0,5376.0,5377.0,5378.0,5379.0,5380.0,5381.0,5382.0,5383.0,5383.1,5383.2,5385.0,5386.0,5388.0,5388.1,5388.2,5388.3,5389.0,5390.0,5391.0,5392.0,5393.0,5394.0,5395.0,5397.0,5399.0,5400.0,5401.0,5402.0,5403.0,5405.0,5406.0,5406.1,5407.0,5408.0,5408.1,5409.0,5409.1,5410.0,5411.0,5412.0,5413.0,5414.0,5416.0,5416.1,5417.0,5418.0,5419.0,5420.0,5421.0,5422.0,5423.0,5424.0,5425.0,5426.0,5427.0,5428.0,5428.1,5429.0,5429.1,5430.0,5430.1,5430.2,5431.0,5431.1,5432.0,5433.0,5434.0,5434.1,5435.0,5436.0,5436.1,5437.0,5438.0,5439.0,5440.0,5441.0,5441.1,5442.0,5443.0,5444.0,5445.0,5446.0,5447.0,5448.0,5449.0,5450.0,5451.0,5452.0,5453.0,5453.1,5454.0,5455.0,5455.1,5456.0,5457.0,5458.0,5459.0,5459.1,5460.0,5461.0,5462.0,5463.0,5463.1,5464.0,5464.1,5464.2,5465.0,5466.0,5467.0,5468.0,5469.0,5469.1,5471.0,5471.1,5472.0,5473.0,5474.0,5474.1,5475.0,5476.0,5477.0,5477.1,5477.2,5478.0,5478.1,5479.0,5480.0,5481.0,5482.0,5483.0,5484.0,5485.0,5485.1,5486.0,5486.1,5487.0,5488.0,5489.0,5489.1,5489.2,5489.3,5489.4,5489.5,5489.6,5489.7,5490.0,5491.0,5492.0,5493.0,5494.0,5495.0,5496.0,5497.0,5498.0,5499.0,5500.0,5501.0,5502.0,5502.1,5502.2,5502.3,5502.4,5503.0,5504.0,5505.0,5505.1,5506.0,5506.1,5507.0,5508.0,5509.0,5510.0,5511.0,5512.0,5513.0,5514.0,5514.1,5515.0,5516.0,5517.0,5518.0,5519.0,5520.0,5521.0,5523.0,5524.0,5525.0,5526.0,5527.0,5528.0,5529.0,5529.1,5529.2,5529.3,5530.0,5531.0,5532.0,5533.0,5534.0,5534.1,5534.2,5535.0,5536.0,5537.0,5538.0,5539.0,5540.0,5541.0,5543.0,5544.0,5545.0,5545.1,5546.0,5547.0,5548.0,5549.0,5551.0,5552.0,5553.0,5554.0,5555.0,5556.0,5556.1,5556.2,5556.3,5556.4,5557.0,5557.1,5557.2,5558.0,5559.0,5560.0,5561.0,5561.1,5561.2,5562.0,5564.0,5565.0,5565.1,5565.2,5565.3,5566.0,5567.0,5567.1,5567.2,5567.3,5567.4,5567.5,5567.6,5567.7,5567.8,5568.0,5569.0,5570.0,5571.0,5572.0,5572.1,5572.2,5573.0,5574.0,5575.0,5576.0,5577.0,5578.0,5579.0,5579.1,5580.0,5581.0,5582.0,5583.0,5584.0,5585.0,5586.0,5587.0,5588.0,5588.1,5589.0,5590.0,5590.1,5591.0,5591.1,5592.0,5593.0,5594.0,5595.0,5596.0,5597.0,5598.0,5598.1,5599.0,5600.0,5601.0,5602.0,5603.0,5605.0,5606.0,5608.0,5609.0,5609.1,5609.2,5610.0,5611.0,5612.0,5613.0,5614.0,5615.0,5616.0,5617.0,5618.0,5619.0,5619.1,5620.0,5621.0,5622.0,5623.0,5624.0,5625.0,5626.0,5627.0,5627.1,5628.0,5629.0,5630.0,5631.0,5632.0,5632.1,5633.0,5634.0,5635.0,5635.1,5635.2,5636.0,5637.0,5638.0,5639.0,5641.0,5641.1,5641.2,5642.0,5642.1,5642.2,5642.3,5643.0,5644.0,5644.1,5644.2,5644.3,5645.0,5646.0,5647.0,5648.0,5648.1,5649.0,5650.0,5651.0,5651.1,5652.0,5653.0,5654.0,5655.0,5656.0,5657.0,5658.0,5659.0,5660.0,5661.0,5662.0,5663.0,5664.0,5665.0,5666.0,5667.0,5668.0,5669.0,5671.0,5672.0,5673.0,5674.0,5675.0,5676.0,5677.0,5678.0,5679.0,5680.0,5681.0,5683.0,5683.1,5683.2,5684.0,5684.1,5684.2,5684.3,5684.4,5684.5,5684.6,5685.0,5686.0,5687.0,5688.0,5689.0,5692.0,5693.0,5693.1,5694.0,5695.0,5696.0,5696.1,5697.0,5698.0,5699.0,5700.0,5701.0,5701.1,5703.0,5705.0,5706.0,5708.0,5710.0,5711.0,5713.0,5714.0,5715.0,5716.0,5717.0,5718.0,5720.0,5722.0,5723.0,5724.0,5725.0,5726.0,5726.1,5727.0,5728.0,5729.0,5729.1,5730.0,5731.0,5731.1,5731.2,5732.0,5732.1,5732.2,5733.0,5734.0,5735.0,5736.0,5737.0,5738.0,5738.1,5738.2,5738.3,5738.4,5739.0,5739.1,5740.0,5740.1,5743.0,5744.0,5745.0,5746.0,5747.0,5747.1,5747.2,5748.0,5748.1,5748.2,5748.3,5748.4,5748.5,5749.0,5750.0,5751.0,5752.0,5753.0,5754.0,5756.0,5757.0,5758.0,5759.0,5759.1,5759.2,5759.3,5760.0,5761.0,5763.0,5764.0,5765.0,5766.0,5767.0,5768.0,5769.0,5769.1,5770.0,5771.0,5772.0,5773.0,5773.1,5774.0,5775.0,5775.1,5776.0,5776.1,5776.2,5776.3,5776.4,5777.0,5778.0,5779.0,5780.0,5781.0,5782.0,5783.0,5784.0,5785.0,5786.0,5787.0,5788.0,5789.0,5790.0,5792.0,5793.0,5794.0,5794.1,5794.2,5795.0,5796.0,5797.0,5797.1,5797.2,5797.3,5798.0,5799.0,5799.1,5799.2,5799.3,5799.4,5799.5,5799.6,5799.7,5800.0,5801.0,5801.1,5802.0,5803.0,5804.0,5804.1,5804.2,5805.0,5805.1,5806.0,5806.1,5806.2,5806.3,5807.0,5809.0,5809.1,5809.2,5809.3,5810.0,5812.0,5812.1,5813.0,5813.1,5813.2,5813.3,5813.4,5814.0,5814.1,5814.2,5815.0,5815.1,5815.2,5816.0,5816.1,5817.0,5818.0,5818.1,5818.2,5818.3,5818.4,5818.5,5818.6,5818.7,5818.8,5818.9,5818.10,5818.11,5819.0,5820.0,5821.0,5821.1,5821.2,5822.0,5822.1,5822.2,5823.0,5824.0,5825.0,5826.0,5827.0,5827.1,5827.2,5828.0,5829.0,5830.0,5831.0,5832.0,5832.1,5832.2,5832.3,5833.0,5835.0,5835.1,5835.2,5835.3,5835.4,5835.5,5835.6,5835.7,5837.0,5837.1,5838.0,5839.0,5840.0,5840.1,5840.2,5841.0,5842.0,5843.0,5845.0,5846.0,5847.0,5847.1,5848.0,5849.0,5850.0,5850.1,5851.0,5852.0,5853.0,5854.0,5854.1,5855.0,5856.0,5856.1,5856.2,5857.0,5857.1,5857.2,5858.0,5858.1,5858.2,5858.3,5858.4,5860.0,5860.1,5861.0,5861.1,5862.0,5863.0,5863.1,5863.2,5864.0,5865.0,5865.1,5865.2,5866.0,5868.0,5869.0,5870.0,5871.0,5873.0,5874.0,5876.0,5877.0,5878.0,5880.0,5884.0,5884.1,5885.0,5887.0,5888.0,5889.0,5890.0,5892.0,5893.0,5893.1,5893.2,5894.0,5894.1,5898.0,5899.0,5902.0,5903.0,5903.1,5903.2,5905.0,5905.1,5906.0,5908.0,5908.1,5908.2,5909.0,5910.0,5912.0,5913.0,5913.1,5915.0,5916.0,5918.0,5918.1,5919.0,5920.0,5921.0,5928.0,5985.0,6003.0,6004.0,6005.0,6007.0,6008.0,6009.0,6011.0,6012.0,6013.0,6013.1,6017.0,6017.1,6017.2,6017.3,6017.4,6017.5,6030.0,6050.0,6050.1,6051.0,6051.1,6052.0,6052.1,6053.0,6053.1,6054.0,6054.1,6055.0,6055.1,6055.2,6056.0,6056.1,6056.2,6057.0,6057.1,6057.2,6058.0,6058.1,6059.0,6059.1,6059.2,6060.0,6060.1,6060.2,6060.3,6061.0,6061.1,6062.0,6062.1,6063.0,6063.1,6064.0,6065.0,6066.0,6067.0,6068.0,6069.0,6069.1,6069.2,6069.3,6069.4,6069.5,6069.6,6069.7,6069.8,6100.0,6100.1,6101.0,6101.1,6102.0,6102.1,6103.0,6103.1,6104.0,6104.1,6105.0,6105.1,6110.0,6110.1,6111.0,6111.1,6112.0,6112.1,6113.0,6113.1,6114.0,6114.1,6115.0,6115.1,6116.0,6116.1,6117.0,6117.1,6118.0,6118.1,6120.0,6120.1,6121.0,6121.1,6122.0,6122.1,6123.0,6123.1,6124.0,6124.1,6125.0,6125.1,6126.0,6126.1,6127.0,6127.1,6128.0,6128.1,6130.0,6130.1,6130.2,6130.3,6130.4,6130.5,6130.6,6130.7,6130.8,6130.9,6130.10,6130.11,6131.0,6131.1,6131.2,6131.3,6131.4,6131.5,6131.6,6131.7,6150.0,6150.1,6151.0,6151.1,6152.0,6152.1,6153.0,6153.1,6154.0,6154.1,6155.0,6155.1,6171.0,6175.0,6175.1,6180.0,6180.1,6188.0,6189.0,6189.1,6190.0,6190.1,6191.0,6191.1,6192.0,6192.1,6193.0,6193.1,6194.0,6194.1,6195.0,6195.1,6196.0,6196.1,6197.0,6197.1,6198.0,6198.1,6199.0,6199.1,6200.0,6201.0,6202.1,6202.2,6203.0,6203.1,6210.0,6211.0,6224.0,6228.0,6228.1,6228.2,6228.3,6229.0,6229.1,6229.2,6232.0,6235.0,6236.0,6242.0,6246.0,6246.1,6249.0,6250.0,6251.0,6252.0,6253.0,6255.0,6256.0,6257.0,6258.0,6259.0,6260.0,6261.0,6262.0,6263.0,6264.0,6265.0,6266.0,6269.0,6270.0,6271.0,6272.0,6273.0,6274.0,6275.0,6275.1,6276.0,6276.1,6277.0,6277.1,6278.0,6278.1,6278.2,6299.0,6300.0,6302.0,6303.0,6350.0,6403.0,6403.1,6406.0,6408.0,6408.1,6409.0,6409.1,6409.2,6410.0,6410.1,6410.2,6412.0,6449.0,6500.0,6500.1,6501.0,6502.0,6503.0,6504.0,6505.0,6505.1,6506.0,6506.1,6507.0,6508.0,6508.1,6508.2,6509.0,6509.1,6509.2,6510.0,6510.1,6510.2,6512.0,6512.1,6512.2,6513.0,6513.1,6513.2,6526.0,6527.0,6528.0,6530.0,6532.0,6533.0,6534.0,6534.1,6535.0,6535.1,6536.0,6536.1,6537.0,6537.1,6539.0,6539.1,6540.0,6541.0,6543.0,6544.0,6544.1,6545.0,6546.0,6755.0,6760.0,6760.1,6760.2,6764.0,6764.1,6765.0,6767.0,6768.0,6768.1,6768.2,6769.0,6771.0,6773.0,6775.0,6775.1,6776.0,6777.0,6777.1,6777.2,6778.0,6780.0,6780.1,6780.2,6781.0,6782.0,6784.0,6784.1,6784.2,6784.3,6785.0,6785.1,6785.2,6786.0,6787.0,6788.0,6788.1,6788.2,6788.3,6788.4,6793.0,6793.1,6794.0,6794.1,6901.0,6902.0,6903.0,6910.0,6920.0,6921.0,6922.0,6923.0,6923.1,6924.0,6925.0,6925.1,6925.2,6925.3,6926.0,6926.1,6928.0,6929.0,6930.0,6930.1,6930.2,6931.0,6934.0,6935.0,6936.0,6936.1,6937.0,6939.0,6940.0,6940.1,6942.0,6942.1,6944.0,6951.0,6952.0,6954.0,6954.1,6959.0,6960.0,6960.1,6960.2,6961.0,6963.0,7000.0,7001.0,7101.0,7102.0,7104.0,7105.0,7201.0,7202.0,7203.0,7205.0,9000.0,9001.0,9002.0,9003.0,9004.0,9005.0,9006.0,9007.0,9008.0,9009.0,9010.0,9011.0,9012.0,9013.0,9014.0,9015.0,9016.0,9017.0,9018.0,9019.0,9020.0,9021.0,9022.0,9023.0,9024.0,9025.0,9026.0,9027.0,9028.0,9029.0,9030.0,9031.0,9032.0,9033.0,9036.0,9037.0,9038.0,9039.0,9040.0,9041.0,9042.0,9043.0,9044.0,9045.0,9200.0,9201.0,9202.0,9203.0,9204.0,9205.0,9206.0,9207.0,9208.0,9209.0,9210.0,9211.0,9212.0,9213.0,9214.0,9215.0,9216.0,9217.0,9218.0,9223.0,9224.0,9225.0,9226.0,9227.0,9228.0,9229.0,9230.0,9231.0,9232.0,9233.0,9236.0,9237.0,9238.0,9239.0,9240.0,9241.0,9242.0,9243.0,9244.0,9245.0,9400.0,9400.1,9401.0,9401.1,9401.2,9402.0,9403.0,9403.1,9403.2,9404.0,9404.1,9405.0,9406.0,9407.0,9408.0,9409.0,9410.0,9411.0,9411.1,9411.2,9412.0,9412.1,9413.0,9414.0,9415.0,9416.0,9417.0,9418.0,9418.1,9419.0,9419.1,9420.0,9421.0,9422.0,9423.0,9423.1,9424.0,9425.0,9426.0,9427.0,9428.0,9429.0,9430.0,9430.1,9431.0,9432.0,9433.0,9433.1,9434.0,9435.0,9436.0,9437.0,9438.0,9439.0,9440.0,9441.0,9442.0,9443.0,9444.0,9445.0,9445.1,9445.2,9446.0,9447.0,9449.0,9450.0,9451.0,9452.0,9453.0,9454.0,9455.0,9456.0,9457.0,9458.0,9459.0,9460.0,9461.0,9462.0,9463.0,9464.0,9465.0,9466.0,9467.0,9468.0,9469.0,9470.0,9471.0,9472.0,9473.0,9473.1,9474.0,9475.0,9476.0,9477.0,9478.0,9479.0,9480.0,9481.0,9482.0,9483.0,9484.0,9485.0,9486.0,9487.0,9488.0,9488.1,9489.0,9490.0,9491.0,9492.0,9493.0,9494.0,9495.0,9496.0,9497.0,9498.0,9499.0,9500.0,9501.0,9502.0,9503.0,9504.0,9505.0,9506.0,9507.0,9508.0,9509.0,9510.0,9510.1,9511.0,9512.0,9513.0,9514.0,9515.0,9516.0,9517.0,9518.0,9519.0,9519.1,9519.2,9520.0,9521.0,9522.0,9523.0,9524.0,9525.0,9527.0,9528.0,9529.0,9530.0,9531.0,9532.0,9533.0,9534.0,9535.0,9536.0,9537.0,9538.0,9539.0,9540.0,9541.0,9542.0,9542.1,9543.0,9544.0,9545.0,9546.0,9546.1,9546.2,9547.0,9548.0,9549.0,9550.0,9551.0,9552.0,9553.0,9554.0,9555.0,9556.0,9557.0,9558.0,9559.0,9560.0,9560.1,9560.2,9561.0,9562.0,9562.1,9563.0,9563.1,9564.0,9565.0,9566.0,9567.0,9567.1,9568.0,9570.0,9571.0,9572.0,9573.0,9574.0,9575.0,9576.0,9577.0,9578.0,9579.0,9580.0,9581.0,9582.0,9583.0,11000.0,11000.1,11000.2,11000.3,11001.0,11001.1,11002.0,11002.1,11003.0,11003.1,11004.0,11004.1,11005.0,11005.1,11005.2,11006.0,11006.1,11007.0,11007.1,11008.0,11008.1,11009.0,11009.1,11010.0,11010.1,11011.0,11011.1,11012.0,11012.1,11013.0,11013.1,11014.0,11015.0,11016.0,11017.0,11017.1,11018.0,11018.1,11019.0,11019.1,11020.0,11020.1,11021.0,11022.0,11022.1,11023.0,11023.1,11024.0,11025.0,11026.0,11027.0,11027.1,11028.0,11029.0,11030.0,11031.0,11200.0,11201.0,11202.0,11203.0,11204.0,11205.0,11206.0,11207.0,11208.0,11209.0,11210.0,11210.1,11211.0,11211.1,11212.0,11213.0,11214.0,11215.0,11216.0,11217.0,11218.0,11219.0,11221.0,11222.0,11223.0,11224.0,11225.0,11226.0,11227.0,11228.0,11229.0,11230.0,11231.0,11232.0,11233.0,11233.1,11233.2,11233.3,11234.0,11235.0,11236.0,11237.0,11238.0,11239.0,11240.0,11241.0,11242.0,11244.0,11245.0,11245.1,11245.2,11245.3,11246.0,11247.0,11248.0,11249.0,11250.0,11251.0,11252.0,11252.1,12000.0,12001.0,12002.0,12002.1,12003.0,12004.0,12005.0,12005.1,12006.0,12007.0,12008.0,12009.0,12010.0,12011.0,12012.0,12013.0,12014.0,12014.1,12015.0,12015.1,12016.0,12017.0,12018.0,12019.0,12020.0,12021.0,12022.0,12022.1,12023.0,12023.1,12024.0,12025.0,12025.1,12026.0,12027.0,12500.1,12500.2,12500.3,12500.4,12500.5,12500.6,12500.7,12500.8,12500.9,12500.10,12501.0,12501.1,12501.2,12501.3,12501.4,12501.5,12501.6,12501.7,12501.8,12501.9,12501.10,12501.11,12501.12,12501.13,12501.14,12501.15,12501.16,12501.17,12501.18,12501.19,12501.20,12501.21,12501.22,12501.23,12501.24,12501.25,12501.26,12501.27,12501.28,12501.29,12501.30,12501.31,12501.32,12501.33,12501.34,12501.35,12501.36,12501.37,12501.38,12501.39,12501.40,12501.41,12501.42,12502.0,12502.1,12502.2,12502.3,12502.4,12502.6,12503.1,12503.2,12503.3,12503.4,12505.1,12505.2,12505.3,12505.4,12505.5,12505.6,12621.0,12621.1,12621.2,12622.0,12622.1,12622.2,12623.0,12623.1,12623.2,12624.0,12624.1,12624.2,12626.0,12626.1,12626.2,12627.0,12627.1,12627.2,12628.0,12628.1,12628.2,12629.0,12629.1,12631.0,12631.1,12633.0,12633.1,12633.2,12634.0,12634.1,12634.2,12635.0,12635.1,12635.2,12636.0,12636.1,12636.2,12637.0,12637.1,12637.2,12638.0,12638.1,12638.2,12639.0,12639.1,12639.2,12641.0,12641.1,12641.2,12642.0,12642.1,12643.0,12643.1,12644.0,12644.1,12645.0,12645.1,12645.2,12646.0,12646.1,12646.2,12648.0,12648.1,12648.2,12649.0,12649.1,12649.2,12650.0,12650.1,12651.0,12651.1,12651.2,12652.0,12652.1,12652.2,12653.0,12653.1,12654.0,12654.1,12654.2,12655.0,12655.1,12655.2,12656.0,12656.1,12656.2,12658.0,12658.1,12659.0,12659.1,12660.0,12660.1,12660.2,12661.0,12661.1,12662.0,12662.1,12663.0,12663.1,12663.2,12664.0,12664.1,12664.2,12665.0,12665.1,12666.0,12666.1,12667.0,12667.1,12667.2,12668.0,12668.1,12669.0,12669.1,12673.0,12674.0,12675.0,12676.0,12677.0,12678.0,12679.0,12680.0,12681.0,12682.0,12683.0,12685.0,12686.0,12687.0,12688.0,12689.0,12690.0,12693.0,12694.0,12695.0,12696.0,12697.0,12698.0,12699.0,12700.0,12701.0,12702.0,12703.0,12704.0,12705.0,12706.0,12707.0,12708.0,12709.0,12710.0,12711.0,12712.0,12713.0,12900.0,12901.0,12902.0,12903.0,12904.0,12905.0,12906.0,12907.0,12908.0,12909.0,12910.0,12911.0,12912.0,12913.0,12914.0,12915.0,12916.0,12917.0,12918.0,12919.0,12920.0,12921.0,12922.0,12923.0,12924.0,12925.0,12926.0,12927.0,12928.0,12929.0,12930.0,12931.0,12932.0,12933.0,13000.0,13000.1,13001.0,13001.1,13002.0,13002.1,13003.0,13003.1,13004.0,13004.1,13005.0,13005.1,13006.0,13006.1,13007.0,13007.1,13008.0,13008.1,50000.0,50000.1,50000.2</sig_subsig_ids>
      </category>
    <category name="S349" cli_name="s349">
      <sigids>6798,5930,6946,5879,5931,6268,6267</sigids>
      <sig_subsig_ids>6798.0,5930.0,5930.1,5930.2,5930.3,5930.4,6946.0,5930.5,5879.0,5931.0,5931.1,6268.0,6267.0</sig_subsig_ids>
    </category>
    <category name="S348" cli_name="s348">
      <sigids>6973</sigids>
      <sig_subsig_ids>6973.0</sig_subsig_ids>
    </category>
    <category name="S347" cli_name="s347">
      <sigids>6945,5589,5858,6131,5601,5583,4004</sigids>
      <sig_subsig_ids>6945.0,5589.0,5858.5,6131.11,5601.1,5583.0,6131.10,4004.0</sig_subsig_ids>
    </category>
    <category name="S346" cli_name="s346">
      <sigids>6298</sigids>
      <sig_subsig_ids>6298.0,6298.1</sig_subsig_ids>
    </category>
    <category name="S345" cli_name="s345">
      <sigids>6524,6520,6184,65