I think it's a little confusing to have a function called _Alert_Json log events like DNS, DROP etc.