The following example triggers alarms when the TLS version is detected for applications that contain SSL in their application path.

function Flow_DetectTlsVersion (dpiMsg, ruleEngine)
-- rule content
  if HasApplication(dpiMsg, "ssl") then
    local tlsVersion = GetTlsVersion(dpiMsg);
    if (tlsVersion ~= nil or tlsVersion ~= '') then
      TriggerUserAlarm(dpiMsg, ruleEngine, "low")
    end
  end
end