SIEM rule message names appear as '0' after a rule purge

Technical Articles ID: KB83649
Last Modified: 9/16/2020

Environment

McAfee SIEM Enterprise Security Manager (ESM) 10.x.x

For product supported environments, see KB82516.

Problem

After you purge the autolearned rules from the McAfee SIEM console, you might see an issue where the date stamp on the rule database is not updated correctly. An incorrect rules database date stamp can leave the SIEM thinking it has an updated version of the rule set when it really does not.

Usually the SIEM rule message names in the dashboard are descriptive, such as User Login, Event_Service_Status_Success, TCP session begin. When this issue occurs, the SIEM rule messages show a rule name of 0. Without having a descriptive rule name, it can be hard to determine the reason for an event.

Solution

To resolve this issue:

Open the Receiver properties, and click Events, Flows, and Logs.
Find Last Downloaded Rule Record and change the date to a date before you installed your SIEM. For example, change the year from 2020 to 1970.

IMPORTANT: Do not change the Last Downloaded Event Record or Last Downloaded String Record fields. Doing so causes the ESM to redownload all records from the receiver, which degrades performance.

Click OK.

NOTE: This change affects all events. Old events with the same signature ID get the new rule name.

Affected Products

SIEM Enterprise Security Manager 10.4.x (EOL)
SIEM Enterprise Security Manager 10.3.x (EOL)

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

SIEM rule message names appear as '0' after a rule purge

Environment

Problem

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

SIEM rule message names appear as '0' after a rule purge

Environment

Problem

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title