Probably a bug in the SOC

[Lesterol]

Version

2.4.50

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

48

RAM

64

Storage for /

500G

Storage for /nsm

1500G

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi guys.
I have a standalone version. If i go to SOC - Administration - Configuration - idstools - config - urls. Here I have the option to enter my url only for the Current Grid Value. I don't have a drop-down list where I could select my standalone version and enter the url value there. And as a result, if I add the url to the Grid, nothing happens.
To solve the problem, I had to edit the /opt/so/saltstack/local/pillar/minions/seconi_standalone.sls file, writing a config like

idstools:
config:
ruleset: 'example'
oinkcode: 'example'
urls:
- example
enabled: true

After restarting idstools and updating the rules, I saw a new field in idstols - config - urls. The seconi_standalone field was added there, where my url was inserted.
In general, the essence of the bug is that in the standalone version it is impossible to apply in SOC a custom url for the node, but only for the Grid. However, after editing the _standalone.sls file, we can do this.
I hope I have conveyed the problem correctly. Please check this case.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[Koen1999]

If you modify the idstools.config.urls option in the Configuration menu in the web UI, you should add urls like this: "https://www.snort.org/downloads/community/snort3-community-rules.tar.gz". Please note the " quotation marks. It probably is a bug indeed, but this workaround works for me.