so-rule disabled, not working in GUI or CLI. (Also: Help Disabling entire categories by 're:regex')

[Odiesinfosec]

Hello,
I am trying to disable some IDS rules, I want to disabled entire rule category (Example, I want to disable all ET POLICY alerts. IIRC I was able to accomplish this in 2.3 using: so-rule disabled add 're:ET POLICY' or 're:ET\sPOLICY' (not too sure about my regex) But I was able to get it to work and disable dozens of SIDS with 1 command.
after installing 2.4 I check my alerts and begin the process of tuning down alerts I don't need.

I tried to do this in web configuration 1 entry per line.

're:ET\sPOLICY[^"]*'

wait 1 hour... and I'm still getting these alerts, Ill check the disabled list on the box itself.
OK ill try the CLI and see if anything disabled.

lets see if the command works:
so-rule disabled
(This should not happen, the system is in an error state if you see this message.)
More than one manager-type pillar exists, minion id's listed below:
"/opt/so/saltstack/local/pillar/minions/adv_so2beta_standalone.sls", "/opt/so/saltstack/local/pillar/minions/so2beta_standalone.sls"

Can anyone help with this? I cant seem to use so-rule disabled for anything. Not sure why I have 2 manager-type pillars.

[dougburks]

After specifying the regex, did you try updating your ruleset with so-rule-update?

[Odiesinfosec]

specify the regex in the web configuration and then run so-rule-update?
I will try and get back to you!

[Odiesinfosec]

Does not disable the rule.
can you help me with the regex to rule it out?
should simply writing 're:ET DROP' in the disabled SIDS web config and then running so-rule-update
Disable all alerts in the ET DROP category?

[dougburks]

Here's a simple test that worked for me:

• enter re:policy in the disabled SIDS web config
• use the Synchronize button in the web UI or do sudo salt-call state.highstate from the CLI
• run sudo so-rule-update

[Odiesinfosec]

Weird, I cant salt-call state.highstate, Its erroring out everywhere. I am running standalone.
I get error failed to add job highstate_shecdule to scehdule
and error failed to add job patch_os_schedule to schedule
Failed to add job salt-minion-state-apply-test to schedule.

[Odiesinfosec]

I think I am going to reinstall from ISO. I can't run soup.