I'm getting logs from ms-exchange through log-binder. In the ASP rules , I have changed one making a copy to filter on specific event and saved it under the ASP rules for Log-binder now whenever the events comes with my specific event in payload it matches the originial one not the one I have made. Why is that? I even tried disabling the original one but still it won't work. My regex is perfect as i tested it with the same payload, it matched the fields I want it to.
Why is my rule not picked up?