Nor in Snort.

Iris isn't adding any "e" ref tags in the raw json; it's just parsing the "note1..." text in the `content`.