SO not seeing any traffic while wireshark does

[JawherNet]

SO can't see any traffic or any alers has been generated during an attack from kali to windows 10 machine. the span port is well configured from pfsense and i am able to see the scan and attack using wireshark from the span interface.
do i miss something to be done ?
the SO version is 2.3

[dougburks]

Have you tried the troubleshooting steps in the documentation?
https://docs.securityonion.net/en/2.3/suricata.html#troubleshooting-alerts