TODO.md: add snort rules