snort rules changing everyday