Have anyone seen this error?
I copied a ASP rule and when attempting to modify that, encountering above error.
I was able to create a new an ASP rule but after that when attempted to change name etc., receiving this error again.
I have created a new ASP rule and added details manually.
I still encountered this issue when attempted to edit that newly created rule.
Couldn't find the reason behind this error.
Would you happen to be running SIEM 10.0.2 (or 10.0.x perhaps)? I had this same problem, but it's been a while so I'm a bit hazy on its solution.
I believe the problem stopped after upgrading to 10.1.3 [NOTE: Do not upgrade to 10.1.3 -- 10.1.4 or 10.2.0 recommended due to an ACE issue]. Seems like the editor didn't like the colon being in the regex, as I recall. If you got rid of all colons you might be able to modify the rule again, otherwise once you created the rule you couldn't modify it. Also --fun fact-- if you had more than one colon and got rid of the earliest instance, but kept a later instance of it, and tried to save... those xxxx numbers would change to indicate the position of the later colon.
Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center