#[2] in the past, the event replied to was part of the thread in Snort. Now this looks kind of awkward as if it was the root of the thread.