Integration Dashboards aren't showing data

[Larockus]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

12

RAM

30Gig

Storage for /

2Tb

Storage for /nsm

212G

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I have my Meraki appliance and O365 sending logs into my installation, but none of the integration specific dashboards show any data. I can search for the specific types of logs but I'm really wanting to have the dashboards available if possible.

O365 dashboard isn't showing anything and the Meraki is throwing the errors displayed below. I'm not sure where to look from here.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[lancebritton]

I am having the same issue with the cisco_asa integration.

[defensivedepth]

@lancebritton @Larockus Can you confirm that you are getting logs for the integration in the Security Onion Console - Hunt or Dashboards?

[defensivedepth]

The Integrations are attached to a Policy, and then the policy is assigned to an Agent - that agent's logs is where you will need to start looking. You can do that from the Fleet interface in Kibana - click on the Agent, then the Log's tab. You can also change the default logging level of a particular agent in that screen as well.

[defensivedepth]

[Larockus]

Looking at the logs I've found the following. Which appears that the configuration changes for the Meraki have successfully been applied to the agent. but I'm still not seeing any events being forwarded from the appliance.

[Larockus]

[dougburks]

Is the Meraki appliance supposed to send the logs to the Elastic Agent?

Are there any firewalls or other network devices that may be interfering with the traffic?

Have you tried using tcpdump to verify that the traffic is arriving?