how to write dynamic rules?

can I do that in Snort 2.3?

First rule to detect outbound email attachment from a particular source
IP address x.

Second rule and Third rule triggered by the first rule

2nd rule: detect port scan from source IP x within 30 minutes, if
detected, then alert

3rd rule: detect multiple port connection from source IP x on a
particular port within 30 minutes , and if the number exceeds the
threshold (e.g. 50 connections), then alert

Thanks