An issue was introduced in 5.3 that caused correlations based on the "All Installed Agents" tool profile group to no work.
A fix was included in 5.3.1, but an issue with agents not showing up correctly in tool profile groups was introduced.
I upgraded to 5.4 on Friday (5/11), and the 5.3 issue of correlations against the "All Installed Agents" tool profile group not working is happening again. The 5.3.1 tool profile group issue appears to be fixed. I created a simple rule that correlates against the "All Installed Agents" tool profile group and infers a host incident if a user logon occurs against a source machine that is not in the group. All agents are placed in this group by default so the rule shouldn’t fire, but the rule fires constantly.
I have opened a new support ticket and all the appropriate information has been submitted, I am just waiting to hear back on the issue being confirmed.
I will post once this issue has been resolved. Save yourself the trouble and hold off on upgrading to 5.4 if you can till a fix is released.
Is anyone else having this issue with 5.4?
Thanks