add snort rule syntax details