After rebuild several integrations nolonger available such as Cisco ISE, Squid Proxy logs. Have these been removed? is the a way to refresh the Integration list

[Bal33p]

Version

2.4.30

Installation Method

Network installation on Red Hat derivative like Oracle, Rocky, Alma, etc.

Description

installation

Installation Type

Distributed

Location

cloud

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

64

Storage for /

500G

Storage for /nsm

30TB

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

After rebuild several integrations nolonger available such as Cisco ISE, Squid Proxy logs. Have these been removed? is the a way to refresh the Integration list

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[dougburks]

Network installation on Red Hat derivative like Oracle, Rocky, Alma, etc.

In my last reply to you, I included the following link. Please keep in mind that network installations are not officially supported:
https://docs.securityonion.net/en/2.4/os.html#supported

After rebuild several integrations nolonger available such as Cisco ISE, Squid Proxy logs. Have these been removed? is the a way to refresh the Integration list

Please see the documentation for supported integrations:
https://docs.securityonion.net/en/2.4/elastic-fleet.html#integrations

[Bal33p]

@dougburks
OK, I have built an ISO image, and alas, no Cisco ISE FTD, ProofPoint TAP, or Squid Proxy. Everything I was using was available and working great before I rebuilt my system. So yes, you are now removing integrations even if they already work.
Can we get these added back? We use the Squid Proxy integration daily.

[dougburks]

Looking back at older discussions, it looks like you installed the Squid integration as a technical preview on a pre-release version of Security Onion:
#10996 (comment)

Since this was not an officially supported integration, this most likely would have required some manual work to manage templates. Furthermore, if and when we added the integration to our list of supported integrations there could have been conflicts with your existing installation. To avoid these issues and to make life easier for everybody, we intentionally configure Elastic to only allow the integrations that we officially support.

We do have an issue for the cisco_ise integration:
#12056

We will take a look at additional integrations as time allows. Priority is given to integration requests from paid customers.

[Bal33p]

Great, I started a discussion with your sales rep yesterday and have a meeting scheduled for today. I have spent a year and countless rebuilds on this project and attempted to report bugs while in beta in an effort to help the community and your work. I sincerely appreciate what you have done and want to send money your way.

[dougburks]

Sounds great, thanks!