# Can I suspend Alert handing to wait libhtp call response function?

**URL:** <https://forum.suricata.io/t/can-i-suspend-alert-handing-to-wait-libhtp-call-response-function/3970>\
**Category:** Developers\
**Created:** [September 28, 2023, 5:43am UTC](https://forum.suricata.io/t/can-i-suspend-alert-handing-to-wait-libhtp-call-response-function/3970 "2023-09-28T05:43:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![peter\_liu](https://avatars.discourse-cdn.com/v4/letter/p/9fc348/32.png) [@peter\_liu](https://forum.suricata.io/u/peter_liu)\
**Post date:** [September 28, 2023, 5:43am UTC](https://forum.suricata.io/t/can-i-suspend-alert-handing-to-wait-libhtp-call-response-function/3970/1 "2023-09-28T05:43:05Z")

</div>

When my rule match the http request, and I want to get response data when handle the alert message.  
How can suspend alert until libhtp finished the response callback?

---

<div class="post-metadata">

**Author:** ![sbhardwaj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/sbhardwaj/32/10_2.png) [@sbhardwaj](https://forum.suricata.io/u/sbhardwaj)\
**Post date:** [October 3, 2023, 10:58am UTC](https://forum.suricata.io/t/can-i-suspend-alert-handing-to-wait-libhtp-call-response-function/3970/2 "2023-10-03T10:58:47Z")

</div>

AFAIK, it is not possible. You can use flowbits to delay the alert and achieve what you want. But, you can always check the http event for all the info once the tx is parsed. See more on this in your other question: [There is no HTTP response header in alert sometimes - #2 by sbhardwaj](https://forum.suricata.io/t/there-is-no-http-response-header-in-alert-sometimes/3968/2)