so-playbook-reset - can't import or have any playbook

[Mav1814]

Version

Other (please provide detail below)

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

4

RAM

32GB

Storage for /

212GB

Storage for /nsm

200GB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello it's me again.

After failing to create a customized playbook it simply doesn't work, the playbook runs, but no alert is generated. I tried resetting the playbooks in order to clean up and then choose the ones that i need to import again. The conclusion?

I did so-playbook-reset and now I can't import any playbooks.
I can't run so-playbook-sigmar-efresh, it says "State file found, exiting...
Rerun with --force to override."
when i use so-playbook-import it says "Play Creation Error - ",
and when I try to access as administrator I get Redmine 500 error.

Has anyone encountered this problem? The documentation doesn't even mention so-playbook-reset.

It's really frustrating to always be chasing losses and not be able to get this stable.

Thanks anyway

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[Mav1814]

Any ideia?

[defensivedepth]

What exactly are you attempting to do?

[Mav1814]

Hi @defensivedepth.

Initially I tried to create a custom playbook for windows #11499. But without success.

The only thing I wanted was to clear out the imported/existing playbooks and import them again. Because I had imported all the available ones in order to test them.

[Mav1814]

Any help?

I cant re-import the playbooks from rulesets, and by doing so-playbook-sigma-refresh or so-playbook-import.

[Mav1814]

Even the IDH playbooks i can't re-import.

[defensivedepth]

The only thing you should need to do to reset the Playbook toolkit is run:

sudo so-playbook-reset

This can take over an hour to completely reset.

Please do this and let me know what you see.

[Mav1814]

I'm running the latest, 2.4.20.

If I'm not mistaken, a new version will be released today.

[defensivedepth]

I may have been able to duplicate the issue. Digging into it further.

[Mav1814]

I'm happy to help in anyway.
I will wait for more updates.

[defensivedepth]

On your Manager, open the following file:

sudo vi /opt/so/saltstack/local/pillar/secrets.sls

Delete the value for the playbook_automation_api_key: - just the value, not anything else. Save it and the run sudo so-playbook-reset

I was able to get it to work on my local system with that change.

[Mav1814]

Okay @defensivedepth i will do it again right now! I will let you know when its done! Thank you for everything.

[Mav1814]

Thank you! Everything is working know.
So the problem was that the API key was adding keys, instead of removing the old one and just adding the new one, right?

[Mav1814]

Another quick questions, the plays of opencanary from the IDH didn't import. What do i need to do?

[Mav1814]

Only had to do so-playbook-import. And it's imported.