print threat level to alerts.log and use the blacklist name instead of the description of malicios IPs in the evidence description

print threat level to alerts.log and use the blacklist name instead of the description of malicios IPs in the evidence description #544