Add filename ref to snort rule