Snort 3 introduces many improvements to simplify rule-writing and increase rule syntax consistency. A traditional Snort rule header contains destination and source networks and ports. New optional header formats simplify detection creation and make rules network and port-agnostic. The new alert file rule header removes the need for two separate rules and tells Snort just to alert on matching files, regardless of the transport service, networks, or ports. An alert http rule, for instance, tells. Snorts current HTTP buffers, including http_uri, http_header, and http_client_body, require application after each match even if multiple matches appear consecutively.”]
Source: https://blog.snort.org/2020/09/converting-custom-snort-2-rules-for.html