When importing a correlation rule using summon correlation, the user_defined_severity and user_defined_category fields are stripped from the output YAML.
When the rule has severity set to "User Defined" or alert_category set to "User Defined", Cortex Platform requires these companion fields to be present. Without them, upload fails with error 101704.
The fix is to conditionally preserving these fields when their parent field is set to "User Defined".
Will be fixed in next release
When importing a correlation rule using summon correlation, the user_defined_severity and user_defined_category fields are stripped from the output YAML.
When the rule has severity set to "User Defined" or alert_category set to "User Defined", Cortex Platform requires these companion fields to be present. Without them, upload fails with error 101704.
The fix is to conditionally preserving these fields when their parent field is set to "User Defined".
Will be fixed in next release