I came back to this today to test the main issue of intrusion detection banning something trusted and the rules were missing, but the system was still set to legacy.
The PBX was rebooted this morning.
I changed it from Legacy to Enabled. Rules still missing.
I changed it back to Legacy. Rules came back.