The firewall rule ID that triggered the firewall alert
Core Alert Fields multiSelect
incident_fwruleid
fwruleid