Kibana "security" section doesn't exist / 404s

[Marshall-Hallenbeck]

Version

2.4.40

Installation Method

Network installation on Ubuntu

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

32

Storage for /

163g

Storage for /nsm

326g

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

I installed SecurityOnion on a Ubuntu VM and have configured it slightly (installed ElasticAgent, allowed firewall rules, etc), however, when I attempt to go to Kibana's security section, it just... doesn't exist:

it shows up in search though:

Everything is green, but I tried restarting everything, including Kibana alone, and tried updating all the passwords via so-elastic-auth-password-reset all, but it still doesn't work.

Logs from /opt/so/log/kibana/kibana.log when I navigate to the webpage:

{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.6.1"},"@timestamp":"2024-03-28T17:52:28.750+00:00","message":"Unable to determine whether upgrade is being performed","log":{"level":"WARN","logger":"plugins.ml"},"process":{"pid":6},"trace":{"id":"33cf98ef3fc02f7d19da3929c3f5e275"},"transaction":{"id":"4894d9bddd908fa6"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.6.1"},"@timestamp":"2024-03-28T17:52:28.881+00:00","message":"Beginning fleet setup","log":{"level":"INFO","logger":"plugins.fleet"},"process":{"pid":6},"trace":{"id":"4db43b7c9f4269d1da9779704c074415"},"transaction":{"id":"bbb1bf44b52a3962"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.6.1"},"@timestamp":"2024-03-28T17:52:29.120+00:00","message":"Failed to fetch latest version of synthetics from registry: Cannot read properties of null (reading 'version')","log":{"level":"ERROR","logger":"plugins.fleet"},"process":{"pid":6},"trace":{"id":"4db43b7c9f4269d1da9779704c074415"},"transaction":{"id":"bbb1bf44b52a3962"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.6.1"},"@timestamp":"2024-03-28T17:52:29.293+00:00","message":"Fleet setup completed","log":{"level":"INFO","logger":"plugins.fleet"},"process":{"pid":6},"trace":{"id":"4db43b7c9f4269d1da9779704c074415"},"transaction":{"id":"bbb1bf44b52a3962"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.6.1"},"@timestamp":"2024-03-28T17:52:29.519+00:00","message":"Failed to fetch latest version of security_detection_engine from registry: Cannot read properties of null (reading 'version')","log":{"level":"ERROR","logger":"plugins.fleet"},"process":{"pid":6},"trace":{"id":"3e1afd6f20e775aeca193c5a4b9b9221"},"transaction":{"id":"cfb40dd0ee964662"}}

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[Marshall-Hallenbeck]

Wow I figured it out... Under Kibana->Spaces->Default, "Search" and "Security" aren't enabled by default, and if they aren't enabled, even if you go to that URL directly, it says it can't be found.