changed bulleted snort rule to code block