@snort   = qw(large packet bad traffic inbound attempt web
              IIS cmd.exe cgi access multiple decode);