Cortex Cloud: "Provided xdm.asset.type.id is invalid" when trying to save a custom rule

"Provided xdm.asset.type.id is invalid" when trying to save a custom rule despite it working inside XQL query builder.

• Cortex Cloud
• Config Rule Builder
• XQL Builder

This is because while the XQL Query Builder will do a best-effort validation to generate its results, the Config rule builder has a validation step when you test it that requires the xdm.asset.type.id to be exactly as in Cortex, respective of case and spelling.

For example, when using "Azure_SQL_Server" as the asset type, you will get results in the query builder. But you will notice in the ASSET.TYPE.ID field gives something slightly different: "AZURE_SQL_SERVER".

Correcting the ASSET_TYPE_ID to what is showing in the UI when executing the XQL will allow the config rule to be tested successfully.