Rule Profile Statistics (worst 7 rules)
==========================================================
   Num      SID GID Rev     Checks   Matches    Alerts           Microsecs  Avg/Check  Avg/Match Avg/Nonmatch   Disabled
   ===      === === ===     ======   =======    ======           =========  =========  ========= ============   ========
     1  1002240   1   1         16        16        16                  78        4.9        4.9          0.0          0
     2 10002164   1   1         16         0         0                  14        0.9        0.0          0.9          0
     3 10002170   1   1          4         0         0                   2        0.6        0.0          0.6          0

- too many checks = bad fast_pattern
- avg match can be high, not a _huge_ deal
- avg non match will be consumed every check, I aim for < 1
- sid not here? no checks or not expensive enough to make the list