/etc/snort/snort.conf
/etc/snort/threshold.conf