Custom rules for netwitness