alert icmp any any -> any any (msg:"SHiRE Sentinel IDS healthcheck"; sid:9900001; rev:2;)