6.3.1
I have a incident that keeps popping up and says the triggered inference rule is called "Authentication Attempt - Default Account" but I do not show this rule in my enabled list.
What am I missing?
-
-
I'd be willing to bet a dollar that you need to click the "Activate Rules" button on the Build → Rules screen.
When you make changes in the Build → Rules screen, you're making changes on the LEM's disk. Rules, however, are processed in memory. You need to click the button to commit the changes on the disk to memory, or you'll see the sort of behavior that you're describing.