I've have a similar issue. All of my alerts show "Src IP: (none)" even though they have agents (v2.4) installed on them. For all my custom rules, if I want to match a specific host, I have to use either <match> or <location> tags.
Anybody know what causes this?
