In reply to Stephen Wolff.

Hi Stephen,
Thank you. The 4187/4 fires when the heartbeat data returned from the SSL/TLS server is more than 128bytes. Of course, you could calibrate that for you environment.
I hope it helps.