1 2 3 4 5 6 7 8 9 10
rule test { meta: foo = strings bar = "bar" strings: $a = "foo" condition: true }