Below lines are correct rules?
alert http $EXTERNAL_NET any -> HOME_NET any (msg:"ET SCAN Arachni Scanner Web Scan"; flow:established,to_server; threshold: type limit, track by_src, count 1, seconds 300; http.user_agent; content:"Arachni/"; pcre:"/Arachni\/v?\d\.\d\.\d/i"; reference:url,[arachni-scanner.com](http://arachni-scanner.com/); reference:url,[github.com/Zapotek/arachni;](http://github.com/Zapotek/arachni;) classtype:attempted-recon; sid:2014869; rev:6; metadata:created_at 2012_06_07, updated_at 2020_06_09;)
#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:“ET SCAN Arachni Web Scan”; flow:established,to_server; content:"/Arachni-"; http_uri; threshold: type limit, track by_src, seconds 60, count 1; reference:url,[www.arachni-scanner.com/;](http://www.arachni-scanner.com/;) classtype:attempted-recon; sid:2017142; rev:2; metadata:created_at 2013_07_12, updated_at 2013_07_12;)