Sourcefire firesight rule update unable to install.

[shunmubala]

Sourcefire firesight rule update unable to install.

Error message:

Import failed: Invalid rule syntax found in file. Verify your rule syntax is correct and that your upload is an ASCII or UTF-8 encoded plain text file. View the rule update log for error details.

May I know anyone face this issue and how do we resolve it.

[Philip D'Ath]

What version of Firesight are you using, and what version is the sensor running?

[ankojha]

Hi,

Could you check if custom variables are added to default set , if not add them to default set and try to import the rule again.

Also, it could be related to a known issue reported in bug CSCze95186 which reports the same error.

Rate if it helps.

Thanks,

Ankita