Custom Property Warning Issue

We are receiving frequent warnings related to “Custom Property Disabled” in our logs. One example involves a regex expression that may be considered expensive or inefficient during processing.

Custom Property: ProcessName

Expression: \s+([A-Za-z0-9_]+)\s(\d+)\s+-

Has anyone experienced similar warnings before? Is there a recommended way to optimize these regex patterns or detect expensive rules automatically before enabling them? We would like to reduce false warnings and improve performance without overlooking important rules.

Any suggestions or best practices would be appreciated.