ASP Parsing Errors: unexpected ':' @ [ xxxx - xxxx]

[suranjitp]

Have anyone seen this error?

I copied a ASP rule and when attempting to modify that, encountering above error.

I was able to create a new an ASP rule but after that when attempted to change name etc., receiving this error again.

Thank you.

Regards.

[Pinard]

Hi Suranjitp

I have the same problem. Have you find a way to solve this issue?

Regards.

[suranjitp]

Hi there,

I have created a new ASP rule and added details manually.

I still encountered this issue when attempted to edit that newly created rule.

Couldn't find the reason behind this error.

Thanks,
Suranjit

[Former Member]

Would you happen to be running SIEM 10.0.2 (or 10.0.x perhaps)? I had this same problem, but it's been a while so I'm a bit hazy on its solution.

I believe the problem stopped after upgrading to 10.1.3 [NOTE: Do not upgrade to 10.1.3 -- 10.1.4 or 10.2.0 recommended due to an ACE issue]. Seems like the editor didn't like the colon being in the regex, as I recall. If you got rid of all colons you might be able to modify the rule again, otherwise once you created the rule you couldn't modify it. Also --fun fact-- if you had more than one colon and got rid of the earliest instance, but kept a later instance of it, and tried to save... those xxxx numbers would change to indicate the position of the later colon.

[suranjitp]

I was running on 10.1.1.

Thanks for the info.