Rules or indicators disappearing or being removed

Products

• Security Analytics

Issue/Introduction

Rules and/or Indicators may disappear because they were removed.  This happens when a user is deleted.

Environment

Release : 8.2.4-55248

Cause

This is a design flaw.  In the past, if an indicator or rule were removed, the rule would continue without a possibility of seeing traffic because there was no indicator.  Now, when a user or indicator is deleted, any indicators and rules associated with the user or indicator are deleted.

Resolution

The design for what happens is changing so that the indicators and rules will not be deleted.  This may disable a rule or assign an indicator to the admin user.  The final design has not been decided.