futft

<rule id="100002" level="0">
  <if_sid>1002</if_sid>
  <match>ntpd</match>
  <description>Ignore ntpd events</description>
</rule>


change to:

<rule id="100002" level="0">
  <if_sid>1002</if_sid>
  <program_name>ntpd</program_name>
  <description>Ignore ntpd events</description>
</rule>