AFAIK, it is not possible. You can use flowbits to delay the alert and achieve what you want. But, you can always check the http event for all the info once the tx is parsed. See more on this in your other question: There is no HTTP response header in alert sometimes - #2 by sbhardwaj