3016011 load error

[lrvy]

1/8/2019 -- 11:15:52 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - rule 3016011 setup buffer http_response_line but didn't add matches to it
1/8/2019 -- 11:15:52 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http any any -> any any (msg:"CobatlStrikt team servers 200 OK Space"; flow:from_server,established; content:"200"; http_stat_code; content:"HTTP/1.1 200 OK|20|"; http_response_line; threshold: type both, track by_src, count 3, seconds 60; reference:url,blog.fox-it.com/2019/02/26/identifying-cobalt-strike-team-servers-in-the-wild/; sid:3016011; rev:1; metadata:created_at 2019_02_27,by al0ne;)" from file /var/lib/suricata/rules/suricata.rules at line 9951

Version：suricata V4.14
大概看了下好像是多了个 http_response_line，去掉之后就不报错了，不过由于学艺不精，不是很熟悉 Snort 语法，还望大佬再确认下

[lrvy]

另发现 3016011 一个误报，url 为 ylog.hiido.com
建议增加以下nocase
nocase; http_raw_header; content:!"ylog.hiido.com"; http_host;

[al0ne]

收到 我有空看看