Re: on 5.7, why is it when I clone a filter, it works but when I create the exact same filter it fails?

Hey Curtis,

Here is a snapshot of the rule. It's little hard to see but there is the original security alerts (SA) the SA clone, and the SA test. SA, SA Clone all have over 1000 alerts and the SA test has 0. They've been running for about the same mount of time.

Also there is no X next to the SA test indicating it is off like those on the bottom