I had a reference to a function in a helper. I removed all references from my rules and from the helper, and now we are receiving alerts with rule import errors similar to the following:
New rule error: ImportError(“cannot import name from ‘helpers’”)
To resolve this issue, stagger changes that remove dependencies. For example:
- Remove references to the helper function in all the detections.
- Wait 30 minutes.
- Remove the function from the helper.
This issue can occur if you make changes to a helper and detection, then the detection engine starts a new run with the updated helper but not with the updated version of the detection.