Are you getting other emails/alerts? Are you getting other emails/alerts from that source?
Assuming the log data is still coming in, the most common reason is clock drift, but it could also be a slight format change in the fields you were keying off of (the connectors do get updated during an upgrade).
I'd recommend digging up one of the events in LEM and check your timestamps first (compare DetectionTime and InsertionTime to current actual time, and potentially the time on your appliance, which is easy to see if you check your internal events/filter), then compare it to your rule to see if we can spot where it's off.