Functionality

I want to know which rule fired on a specific message. Is there a way to parse a message for the specific rule ID that fires?

Yes. If you run the message through your system and look at the sniffer logs then you will get the rule ID and symbol for each rule that matched (unless you have your configuration set to single line).

Alternately, you can run MsgSniffer at the command line against any file you wish and it will produce a log file with all of the matching rule IDs, symbol, index-endex, and so forth.