How can I regenerate the so-import-pcap url you get when its done?

[iqworks]

Hi, after running so-import-pcap, it generates a url. But since my scroll was not working, I couldn’t get back to it.

How can I get that url without rerunning so-import-pcap? Or maybe I just don’t know where to find it?

Thanks again

[dougburks]

From https://docs.securityonion.net/en/2.3/so-import-pcap.html#usage:

so-import-pcap calculates the MD5 hash of the imported pcap and creates a directory in /nsm/import/ for that hash.

You should be able to go to SOC Dashboards and search for one of those MD5 hash values to see all of the logs for that import. You may need to manually adjust the time of the search to match the time of the pcap.

[iqworks]

I saw that link, it was very helpful. I will check out the MD5 from the SOC.
thanks for your help.

[iqworks]

I saw this
What is the meaning of virtualization?
Virtualization creates a simulated, or virtual, computing environment as opposed to a physical environment. Virtualization often includes computer-generated versions of hardware, operating systems, storage devices, and more.

You are right, I misunderstood virtualization. So, I am already learning this. I may not understand all of it right now, but I learn anything one step at a time.

Thanks as always for your suggestions and advice.