We have heard reports of problems after upgrading ESA from 10.4.0.x to 10.4.1. After the upgrade, all rules are not visible in the SA Server WebUI.
We have posted solution KB000029906 to address this problem.
See https://rsaportal.force.com/customer/articles/Break_Fix/Event-Stream-Analysis-ESA-Rules-disappear-from-the-SA-GUI-after-… for an explanation and steps to correct this problem.
Basically, the upgrade points tokumx to a new and empty database rather than the existing database.
Thanks to Jake, Jay, David and others who identified and wrote the solution to fix this problem.
