Only if i run so-test command it showing the alerts in the alert dashboard. Urgent!

[sandraimmaculate]

Hi, my alert dashboard is empty!
only if i run so-test command it showing the alerts in the dashboard for only at that particular time after a minute again the dashboard is becoming empty.
I mean it will show the past alerts and current alert up-to so-test command runes

[cm-ops]

#1720 Can you give some specifics on your install/grid?

[sandraimmaculate]

please reply!

[DebianGuru]

I can't help you any further. I have no knowledge of AWS. I'd be googling for terms like "AWS" and "Promiscuous" and "sniffing", etc. Good luck.

[cm-ops]

Have you reviewed https://docs.securityonion.net/en/2.4/cloud-amazon.html and https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html?

[sandraimmaculate]

yes, but i didn't used security onion image manually i have installed the security onion in rocky like, i have added the NIC card like how they have mentioned in document! with the same subnet which i have used for instance and security group!

but i want to know the alert dashboard is empty because of this reason ? because the second eth1 is collecting traffic very slowly not like eth0 but atleast those few traffic it has to show in dashboard right. it only showing the alerts only when i run so-test command
IDK what is the reason!

[cm-ops]

You are only seeing ARP requests on your monitoring interface according to you reply above. You need to look at your networking configuration/traffic mirror in AWS.