On occasion, the SIEM Event Receiver may behave unexpectedly or becomes unresponsive after enabling ASP Rules in the Default Policy and individual data sources stop parsing. In some cases, complete parsing failure on the Receiver might occur. This is because ASP Rules are not designed to be enabled at the Default Policy level. They are only meant to be enabled at the Data Source/Parent level.
SNS ProTips help you maximize your protection with troubleshooting, best practices, how-to tips, and links to Knowledge Center resources. To unsubscribe from ProTips or change your SNS settings, visit the SNS Subscription Center