$ 0 0 Your connector needs an update. The deny keyword is not making it's way to the normalized alert. See normalized events below from your log