factored snort_file for use by blacktar