[hobbit] multiples keywords in alert rules