TODO.md: add pattern to snort rules idea