I want to disable strelka.

[89sooner]

Hello, thank you in advance. I would like to stop the Strelka engine in the forward node.

I am currently using Suricata for the purpose of IDS, and everything else has been disabled, but I don't know how to disable Strelka.

Please help me.

[cm-ops]

Change the below in SOC to false

[89sooner]

Thank you!
but my security onion version is 2.3.210..

[cm-ops]

In 2.3 that setting is in /opt/so/saltstack/local/pillar/global.sls.

[TOoSmOotH]

Thank you! but my security onion version is 2.3.210..

That would have been helpful information to include in your original post. 2.3.X support ends in 3 weeks so I would really look into upgrading.