adding support for multiple rules, updated audit.rules.json