bro-large_uploads
Raises notices on any large uploads to the Internet and emails alerts on sufficiently large uploads if enabled.
Source must be a local net and destination must not be a local net.
Will also raise alerts on multiple large uploads seen from the same source IP in Y amount of time.