snort.rb: match other snort rule actions