2.4 and availability alerting

[rosswakelin]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32

Storage for /

250Gb

Storage for /nsm

1Tb

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi everyone.

We are happily using 2.3 at the moment, and looking to move to 2.4 when we are happy with the functionality.
One of the things "missing" in 2.4 (as opposed to 2.3) is the ability to generate alerts when something goes wrong. There is great documentation/examples within 2.3 around using events out of Grafana when "things to wrong". Typically this is stuff like monitor port ingest rates dropping below the expected levels (indicating a SPAN port issue) or available disk space dropping below a threshold.
With the removal of Grafana from 2.4, this methodology obviously no longer applies. When 2.4 first appeared, there was a comment that "similar alerting functionality will be available in 2.4 - more details to come".
Does anyone know what that functionality is, how to set it up etc. - where are the details.

Thanks
Ross

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[robbiemarshall]

In 2.4, this functionality is being provided by InfluxDB. You can find more information about it here: https://docs.securityonion.net/en/2.4/influxdb.html