SecO rules location.

[tasno5]

Version

2.4.3

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

500

Storage for /nsm

500

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Has anyone had an issue with where the rules are located in an air-gapped environment? There are no rules in the default /nsm/repo/rules location.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[dougburks]

Have you checked /nsm/repo/rules/suricata/?

[tasno5]

I have pulled down the Latest version: 2.4.30. I am installing it now as a manager on an air-gapped environment.

[tasno5]

Installed the lates 2.4.30 as a distributed manager in an air-gapped environment and having the same rules missing issue under /nsm/repo/rules.

[dougburks]

For 2.4.30, the correct location should be /nsm/rules/suricata/. I've updated the documentation to reflect this:
https://docs.securityonion.net/en/2.4/airgap.html

We also found an issue in soup related to this which should be resolved in an upcoming hotfix:
#11932

[tasno5]

Thank you for that I thought I was losing my mind. Would that location also be causing the issue of no alerts coming through on the main dashboard page? Also nothing in Kibana. Usually with the default rules many alerts kick off.

[dougburks]

If you installed 2.4.30, then you should have a full set of rules in /nsm/rules/suricata/ and Suricata should be able to analyze network traffic and generate alerts. Assuming the rules are there, then please follow the Troubleshooting Alerts section of the documentation:
https://docs.securityonion.net/en/2.4/suricata.html#troubleshooting-alerts