Eventgroup changes

Tweaks to rules that identify distinct attacks from single ip. Updated
readme.