tacotuesday

I'll open a ticket. Just to keep anyone updated who is curious. I found a past detection of Y0064 and selected edit rule. When looking at the details, it appears the rule has been deleted.

I went to modify one of my exclusions today and can no longer find it. I couldn't find the corresponding rule either [Y0064]. Are rules and custom exclusions often deleted as part of a rules and exclusions update? I'm guessing this occurred today for the 1049 update. I actually can't find any of the rules that started with Y. I believe they were titled "Enrichment". Is there a change log for rule and exclusions updates? If Y0064 ever comes back will my custom exclusions be restored? I had quite a bit of time into writing those exclusions.

I see the "Diagnostic Information" now within the detection details pane. I'll open a support ticket.

Thank you for the reply Marcos. I'll try to remove the signature type and change the case on "Operations" and "Condition". I don't have a diagnostician information option for my detection. Do I need to enable it somewhere?

I'm having an issue with several exclusions. Exclusions that previously worked are failing to resolve some new detections. If I open the exclusion, and then click the "Update Exclusion" button without changing anything, the detection(s) will then be resolved. Has anyone else experienced this? Attached is an example detection and exclusion. After I took a screen shot of the exclusion criteria, I clicked the "Update Exclusion" button. When I went back to the detections screen the detection had been removed.