Duplicate EventIDs
Open
Nobody has claimed this yet.
bug
- Dominant language
- JavaScript
- Stars
- 104
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
Root cause presently unknown, but occasionally a few signatures will somehow be assigned the same EventID. This is not validated until attempting to push signatures on the deployment box.
The current solution is to change the signature category then change it back so the next available EventID for the category is assigned.
Example:
Changing the newest of each rule to EC then back to MC assigns them EventIDs 5002064 and 5002065 respectively.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.