Article Number
000032752
Applies To
RSA Product Set: Security Analytics
RSA Product/Service Type: Event Stream Analysis (ESA)
Version/Condition: 10.5.2
Issue
For a cross-site deployment, when you change the name of an advanced rule, the forwarding rule does not change along with the name change for the advanced rule.
This can result in an orphaned rule which can continue to forward events.
Resolution
This issue is being investigated by the Engineering team in order to provide a permanent resolution in a future release.
Workaround
To rename a cross-site advance rule, create a new rule and delete the old one.
