Issue with Integration of Security Onion with DFIR-IRIS Case Management

[medahalli]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

6

RAM

20 GO

Storage for /

400

Storage for /nsm

400

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Dear Security Onion Community,

I'm reaching out regarding an issue I'm encountering while integrating Security Onion with another case management tool, DFIR-IRIS. Upon consulting the documentation, I found that it's necessary to configure the "cases" module to "httpcase" and provide specific parameters for this module.

Below is the configuration I attempted to add in the defaults.yaml file in /salt/soc :
server:
bindAddress: 0.0.0.0:9822
baseUrl: /
maxPacketCount: 5000
htmlDir: html
importUploadDir: /nsm/soc/uploads
airgapEnabled: false
modules:
cases: httpcase
filedatastore:
jobDir: jobs
kratos:
hostUrl:
elastic:
hostUrl:
remoteHostUrls: []
username:
password:
index: ':so-,:endgame-,:logs-'
cacheMs: 300000
verifyCert: false
casesEnabled: true
extractCommonObservables:
- source.ip
- destination.ip
timeoutMs: 300000
timeShiftMs: 120000
defaultDurationMs: 1800000
esSearchOffsetMs: 1800000
maxLogLength: 1024
asyncThreshold: 10

  Despite adding this configuration, I'm still encountering errors when attempting to escalate cases. Specifically, I'm receiving the following error message:

{"fields":{"error":"ERROR_CASE_MODULE_NOT_ENABLED","requestId":"f1cf02c7-d80c-4c4f-82a4-010ee0851ef9","requestor":{"id":"9992b988-c920-4618-b61d-afd3d1004eb6","createTime":"2024-04-25T09:24:50.533196271Z","updateTime":"0001-01-01T00:00:00Z","email":"[email protected]","firstName":"","lastName":"","totpStatus":"disabled","oidcStatus":"disabled","webauthnStatus":"enabled","note":"","roles":null,"status":"","searchUsername":"","password":"","passwordChanged":false}},"level":"warn","timestamp":"2024-04-25T09:24:50.533281243Z","message":"Request did not complete successfully"}

I have also attached my attempted configuration of the httpcase module for your reference.

I would appreciate any guidance or assistance you can provide in resolving this issue and successfully integrating Security Onion with DFIR-IRIS.

Thank you for your attention to this matter.

Sincerely,

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

https://docs.securityonion.net/en/2.4/cases.html is the supported case management tool in SO. You might be able to make this work, but it is not supported.