A Snort rule: seven header fields, then payload options

Answer

alert tcp any any -> 10.1.0.0/16 80 ( \ msg:"SQL keyword in an inbound web request"; \ content:"union select"; nocase; \ classtype:web-application-attack; sid:1000017; rev:1;)

Header, in order: action (alert = alert then log), protocol (tcp), source address (any), source port (any), direction (->), destination address (10.1.0.0/16), destination port (80). Then options: msg and classtype are meta-data and do not affect detection; content is a payload option; nocase modifies the content keyword immediately before it, not the rule.

Stallings & Brown, Computer Security 5e, ch8 §8.3–§8.9