It seems this is quite involved. It will also force ppl to update their classification.config, or they will get errors. I propose to use the existing "protocol-command-decode" classification we are also using in various app-layer-events. Would that work for you Eric?