"Message = " rule not applied properly

[LaurentR]

I copied the message text of a signature to a rule that uses "Message =" like this:

Rules.png

The Signatures tab seems to agree that the rule has been applied. The "number of rules affected" is also set to 1 as expected.

Signatures.png

However, the rule is not actually applied. I tried this the other way by blocking all and setting the "Message =" rule to Disable and everything is blocked, so the rule was still not applied.

If I use "Message contains", it works as expected.
If I use "Signature Identifier =", it also works as expected.

This is not a critical issue as either of the above does the job, but it's a bit surprising that the Signatures tab says something and something else is applied to the actual engine.

[relink]

I am noticing the same thing.

[relink]

Actually to correct what I said the other day, My rules don't seem to be followed no matter how I set them up.

[cblaise]

Confirmed. This will be fixed in 14.2.