Only took about a month to actually fix itself but this is ridiculous that it took so long to import rules. Lucky that this is a client that is still in the early stages of on boarding but if significant alerts were missed then this could have much worse.
Cant Import Sentinel Alert Rules
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 66%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEG%3C/text%3E%3C/svg%3E)
Eugene Golovanyuk
45
Reputation points
Good morning,
I am having difficulty importing sentinel rules after I deleted old ones. I deleted the old rules on friday 9/27 9am EST and am getting the error the rule with ID 'xyz' was recently deleted. You need to allow some time before re-using the same ID. Please try again later. It has been 3 days so I figured this would already be good to do again. Any potential insight on this would be greatly appreciated!
Thank you!
Microsoft Security | Microsoft Sentinel
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(48, 74%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ED8%3C/text%3E%3C/svg%3E)
Dave-8102 0 Reputation points2024-10-15T04:24:12.5366667+00:00 We have the same issue, its been over 72 hours and still can't redeploy.
"The rule with id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' was recently deleted. You need to allow some time before re-using the same id. Please try again later."
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(140.8, 64%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPK%3C/text%3E%3C/svg%3E)
Patrik Karlsson 0 Reputation points2024-10-21T10:12:28.0966667+00:00 Same here, i removed the rule 7 days ago and we still cant deploy anything with that ID. Any news on this?
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 54%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
SpaKwOrK 0 Reputation points2024-10-24T07:29:01.38+00:00 Same for us, we removed all the rules 4 days ago in a workspace, we use workspace manager to redeploy it, at this moment we have the same conflict messsage...
Last year i wait 45mn i think, now its 4 days and judging by the messages above, it won't work right away.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 71%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Julien 0 Reputation points2024-10-24T07:32:08.27+00:00 Same for us
-
Julien 0 Reputation points
2024-10-24T07:33:10.7333333+00:00 We got the same issue
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 94%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIG%3C/text%3E%3C/svg%3E)
Igor Guarisma 0 Reputation points2024-11-07T18:19:18.3966667+00:00 We're experience the same issue, over 24h wait is way too much.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 7.000000000000001%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMG%3C/text%3E%3C/svg%3E)
Émilio Gonzalez 0 Reputation points2025-08-05T15:00:32.24+00:00 It's ridiculously terrible UX that this is even a thing. We manage our detection rules as code and this hinders our capability to modify rules, because we need to delete and re-create them often. Please Microsoft do something about this, it really sucks and has real negative impacts on your customers.
Sign in to comment