Have anyone seen this error?
I copied a ASP rule and when attempting to modify that, encountering above error.
I was able to create a new an ASP rule but after that when attempted to change name etc., receiving this error again.
I have created a new ASP rule and added details manually.
I still encountered this issue when attempted to edit that newly created rule.
Couldn't find the reason behind this error.
Would you happen to be running SIEM 10.0.2 (or 10.0.x perhaps)? I had this same problem, but it's been a while so I'm a bit hazy on its solution.
I believe the problem stopped after upgrading to 10.1.3 [NOTE: Do not upgrade to 10.1.3 -- 10.1.4 or 10.2.0 recommended due to an ACE issue]. Seems like the editor didn't like the colon being in the regex, as I recall. If you got rid of all colons you might be able to modify the rule again, otherwise once you created the rule you couldn't modify it. Also --fun fact-- if you had more than one colon and got rid of the earliest instance, but kept a later instance of it, and tried to save... those xxxx numbers would change to indicate the position of the later colon.