alert tcp ( sid:1200007;  msg:"Custom SD Pattern Passport Numbers"; sd_pattern:"^(?!^0+$)[a-zA-Z0-9]{6,9}$",threshold 10; service:http,ftp,smtp,imap,pop3; classtype:sdf; rev:1; )