I had tried that. Still no luck.
Be sure to double-check your setup. I ran your original signature
and indeed there was no match, and then made the change to /.*version/
that Robin indicated and it now does indeed match. (no need to include
ntp.bro, but it doesn't hurt either)
Vern