Issue with Merging Cases in Elasticsearch from Security Onion

[medahalli]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

6

RAM

20 GO

Storage for /

400

Storage for /nsm

400

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

Hello,

I'm encountering an issue while attempting to merge cases in Elasticsearch from within Security Onion. Following the documentation of Security Onion https://docs.securityonion.net/en/2.4/soc-customization.html#escalation , I switched the cases module to elasticcases. However, when attempting to perform the merge operation, I'm encountering the following error:

(fields": ("error": "Post "https://10.0.3.1:5601/api/cases\": http: server gave HTTP response to HTTPS client"), "level": "warn" timestamp" :"2024-04-26T15:24:33.4546195872*, "messag failed to submit request

It seems like the HTTP server is giving a response to an HTTPS client. I've verified that my Kibana server is configured to accept HTTPS connections, and I've checked that the SSL certificate is valid.

Could someone please provide guidance on how to resolve this issue and successfully merge cases in Elasticsearch from within Security Onion?

Thank you for your assistance.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.