When my rule match the http request, and I want to get response data when handle the alert message.
How can suspend alert until libhtp finished the response callback?
AFAIK, it is not possible. You can use flowbits to delay the alert and achieve what you want. But, you can always check the http event for all the info once the tx is parsed. See more on this in your other question: There is no HTTP response header in alert sometimes - #2 by sbhardwaj