I think this problem may only occur when the alert frenquency level is set to “very high” and component monitor is set to “Turn On”. A few times now, I have seen identical rules. In one instance I had three rules (different ip’s) but everything else was the same and when I changed the “destination ip” to any, two merged as one (with the “any” setting) and the other kept the ip address.
See screenshot below. Both had identical details and component monitor wasn’t involved (Turned on but not prompted for dll’s).
[attachment deleted by admin]
Yeah. It should have merged them. No matter. New rules are coming.
When do you plan to release these new rules? Are these the rules with advanced configuration button?
After the multi language based release. No not the advanced rules. It is something else.
Graham1, Is the parent path the same on the second rule?
Yes, both details are identical.
Okay, I kind of figured you checked that already. Just making sure