DNS rule intrusion events never alert with firepower module

[babiojd01]

I enabled a few DNS blacklist snort rules along with creating my own. None of them will trigger an alert/intrusion event. I verifed that the rules are enabled and everything. I took these same rules and applied them to open source snort and they do trigger. Is there something missing out of the default sourcefire firesight config?

[babiojd01]

Follow up. Out of all the blacklist rules in the sourcefire ruleset 1 single rule triggers an alert out of all of them.

[babiojd01]

Nevermind. I figured it out. It has to do with global thresholding. It also doesn't seem to like 4 letter domain name to test with.