I am receiving the error "Rule correlation( could not update policy, unable to parse xml file" when attempting to roll out policy. i have manually updated the rules as i have seen suggested but the issue persists. Has anyone else had this issue regarding policy rollouts?
Are those alerts based on the event id 36725 ? of Epo
check the correlator log on ACE, it should say the signature ID of the rule(s) that has issue needs fixing.
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA