I think I did that with the event ID string, but was just a fuckup.

I was totally expecting Snort to render the note or event itself, but that didn't happen.