format timeline_rule.py
filter content for RulesWidget by rule type
add ntfs sn = 1 rule