diff --git a/etc/rules/apparmor_rules.xml b/etc/rules/apparmor_rules.xml
index f5f38f50a..3e4722195 100644
--- a/etc/rules/apparmor_rules.xml
+++ b/etc/rules/apparmor_rules.xml
@@ -14,6 +14,7 @@
 <group name="local,syslog,apparmor">
 
   <rule id="52000" level="3">
+    <if_sid>5100</if_sid>
     <decoded_as>iptables</decoded_as>
     <pcre2> apparmor=</pcre2>
     <description>Apparmor grouping</description>