Custom Snort Rules

For example, this specifies a logical message whenever Snort notices any traffic that is sent from 192.168.1.35:

alert tcp 192.168.1.35 any -> any any (msg:"Traffic from 192.168.1.35";)

REF: http://archive.oreilly.com/pub/h/1393