Hi David, thank you. Yes... I also got confused about the "../" string, i don't find it in the packet but the rule matches and alerts. It was also a question i'm about to ask you guys. What do you mean by http_uri be normalized?