AlienVault OTX (ti_otx) integration not being parsed.

[jaypfe]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

60

RAM

128

Storage for /

256

Storage for /nsm

256

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello! I am having issues with this integration akin to a couple of versions ago before any were supported. I can see its installed, and it is outputting data, but its using the so-logs index template

I believe this is because there are two flavors to this integration, and the one subscribed pulses flavor that I am using does not seem to have a custom SO template

My continued appreciation for your product!

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[cm-ops]

From the CLI, what does this return - so-elasticsearch-query _index_template/logs-ti_otx.pulses_subscribed | jq?

[jaypfe]

{
"index_templates": [
{
"name": "logs-ti_otx.pulses_subscribed",
"index_template": {
"index_patterns": [
"logs-ti_otx.pulses_subscribed-*"
],
"template": {
"settings": {},
"mappings": {
"_meta": {
"package": {
"name": "ti_otx"
},
"managed_by": "fleet",
"managed": true
}
}
},
"composed_of": [
"logs-ti_otx.pulses_subscribed@package",
"logs-ti_otx.pulses_subscribed@custom",
".fleet_globals-1",
".fleet_agent_id_verification-1"
],
"priority": 200,
"_meta": {
"package": {
"name": "ti_otx"
},
"managed_by": "fleet",
"managed": true
},
"data_stream": {
"hidden": false,
"allow_custom_routing": false
}
}
}
]
}

[cm-ops]

What index are the logs going into?

[jaypfe]

They are going into .ds-logs-ti_otx.pulses_subscribed-default

I did verify it worked on the other switch that had a custom SO template. It parsed as expected.
Just not the on the pulses_subcribed option, I think this could be because there is no SO index template for this. So its pulling the SO-logs one.

[cm-ops]

I'll test something and report back.

[cm-ops]

I did get this working, fix here #12176

[jaypfe]

Nice!!
Thank you!