In snort if you enable debug menu you can copy event JSON and that will show you the relays.