Flow alerts rules

Hi,

I see we have an "Alerts dashboard" where, for now, I could only see
that one computer was infected with an app that did some webmining.

What rules does ntop/ndpi uses for those flow alerts? Can I load snort
rules?

Thank you.

Best regards,
Dan Craciun