no alerts 2.4 eval version

[mydogboris]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Eval

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

1 core 6 threads

RAM

24 gigs

Storage for /

200 GB

Storage for /nsm

400 GB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I have a brand new eval install of SecurityOnion 2.4.6 on Proxmox with a usbc 1G network adapter as the monitoring port. I am spanning a port on my switch and confirmed with wireshark and a laptop that all traffic is being spanned to the port. I previously had a working eval version that was showing alerts and working well. It stopped working about a week ago and despite a lot of effort I was unable to get it working again. I did a clean install of SecurityOnion eval and everything completed without error. Still, when I go into Alerts I have zero items listed. I have run nmap scans on the network to generate alerts and nothing shows up. Any suggestions would be appreciated.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Do you see an index for suricata logs? You can check with sudo so-elasticsearch-indices-list .