Security Onion 2.4.10 Virtual Machine Import PCAP Failure

[Keith-2nd]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Import

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16GB

Storage for /

200GB

Storage for /nsm

I am unsure

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

[ERROR ] Command '/usr/sbin/so-elastic-fleet-es-url-update' failed with return code: 1
[ERROR ] stdout: Failed to query for current Fleet Server URLs...
/usr/sbin/so-elastic-agent-grid-upgrade failed to run. I am assuming because there is no connection to the internet.

This is a part of an isolated student lab set up with a Security Onion 2 VM and Ubuntu 22.04 VM within VMware Workstation with the intent to move it onto an ESXi environment. The Ubuntu VM can access the SO VM with no issues. Neither VM has internet access. My goal is to be able to import PCAPs from the Ubuntu 22 VM and use the SOC for analysis. When using Grid or so-import-pcap no alerts show on the Dashboard. I have tried running the url-update script from the error log, that did not work. In Grid, it states Kibana is running and healthy; however, when I try to access Kibana it states the server is not ready. This is the same for Elastic Fleet and Osquery Manager.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[defensivedepth]

Have you tried the latest version, 2.4.30? There have been alot of stability fixes from .10 to .30

[Keith-2nd]

No I have not. Would upgrading be the best solution for this situation?

[defensivedepth]

With it being just an import node, I would suggest a fresh install of the latest version.

[Keith-2nd]

Thank you. These logs are tough to track with everything in Elastic failing.