-
Version2.4.70 Installation MethodSecurity Onion ISO image Descriptionupgrading Installation TypeDistributed Locationon-prem with Internet access Hardware SpecsExceeds minimum requirements CPU8 RAM32 Storage for /100GB Storage for /nsm500GB Network Traffic Collectionspan port Network Traffic Speeds1Gbps to 10Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsYes, there are additional clues in /opt/so/log/ (please provide detail below) DetailMy problem is that in the Detections tab i have the following: The problem accured when i updated from 2.4.60 -> 2.4.70 with soup. iv'e tried Differential Update, and Full Update, on each engine, nothing worked. Suricata: Strelka: I would have uploaded some logs from /opt/so/log/suricata but for some reason its completely empty. But i have nothing in the file which is described in the documentation. I hope someone is able to help me based on the information iv'e provided. Guidelines
|
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 55 replies
-
|
Can you run this query and check the contents of the
This looks a lot like the issue I also aimed at describing in #13112 |
Beta Was this translation helpful? Give feedback.
-
|
Thats a lot of text, ill have to upload a txt with that. |
Beta Was this translation helpful? Give feedback.
-
|
It looks like the same issue to me. ETOPEN rules are recognized by the detection module as |
Beta Was this translation helpful? Give feedback.
-
|
yea, i have no idea what else to do tbh, and it seems theres not a lot of people with the issue yet. |
Beta Was this translation helpful? Give feedback.
-
|
If I find a solution, I will for sure let you know. |
Beta Was this translation helpful? Give feedback.
-
|
@GitGoodGod Do you have any kind of custom configurations or changes in place? |
Beta Was this translation helpful? Give feedback.
-
|
No custom suricata rules, did have back in 2.3, but made a complete wipe and started fresh with 2.4. |
Beta Was this translation helpful? Give feedback.
-
|
Please run |
Beta Was this translation helpful? Give feedback.
-
|
Looks like this: |
Beta Was this translation helpful? Give feedback.
-
|
Still trying to replicate this internally. Can you post a sanitized copy of this? |
Beta Was this translation helpful? Give feedback.
-
|
so the file is very long and would take forever to sanitize it, so i just cut it short. suricata:
config:
vars:
address-groups:
Word_Word_Word_Word_Word:
- xx.x.x.x/x
Word_Word_Word_Word:
- x.x.x.x/x
Word_Word_Word_Word_Word_Word_Word_Word:
- xx.x.x.x/xx
Word_Word_Word_Word_Word_Word:
- x.x.x.x/xxThis has never been an issue btw. |
Beta Was this translation helpful? Give feedback.
-
|
Ok, let's try a different approach:
And then click a Full Update for Elastalert and post the logs that you see. |
Beta Was this translation helpful? Give feedback.
-
|
I dont see a salt error? |
Beta Was this translation helpful? Give feedback.
-
|
The ID: so-elasticsearch-templates, is failed. |
Beta Was this translation helpful? Give feedback.
-
|
So that is the root issue. The elasticsearch templates are not being updated, which means, the new Detections template is not being loaded, which means Detections cant be imported. Please post more context around the error. It should show you under |
Beta Was this translation helpful? Give feedback.
-
|
i can give the whole salt-call process ? not sure what else to give. this issue only occured of an Soup from 2.4.60 -> 2.4.70. |
Beta Was this translation helpful? Give feedback.
-
|
so what i see, this is the error i guess: so something is up with the "phases" somewhere ? this is the so-case-template.json file {
"composed_of": [
"case-mappings",
"case-settings"
],
"index_patterns": [
"so-case*"
],
"priority": 500,
"template": {
"mappings": {
"date_detection": false,
"dynamic_templates": [
{
"strings_as_keyword": {
"mapping": {
"ignore_above": 1024,
"type": "keyword"
},
"match_mapping_type": "string"
}
}
]
},
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": 1500
}
},
"number_of_replicas": 0,
"number_of_shards": 1,
"refresh_interval": "30s"
}
}
},
"phases": {
"delete": {
"min_age": 90
}
}
}is it fine ? |
Beta Was this translation helpful? Give feedback.
-
|
Can you post the contents of |
Beta Was this translation helpful? Give feedback.
-
|
Everything goes through fine it seems like, i do not get errors: but this might be the problem: can this be and integrity check report bug or something, i cant really find any reasons why it would fail otherwise. because the checks goes through as "integrity check passed"
|
Beta Was this translation helpful? Give feedback.
-
|
I dont see any issue with that integrity check report - it is not reporting any errors. So are you all green at this point?
|
Beta Was this translation helpful? Give feedback.
-
|
No, I'm only Green in ElastAlert and Strelka. Suricata says Migration Failed. and I can't seem to find the issue, I've tried to look into different discussions on here as well, and I have absolutely no clue why it says it. as you say, it should be showing Green, as it gives no errors what so ever. |
Beta Was this translation helpful? Give feedback.
-
|
v.2.4.80 soup fixed the suricata migration failed problem it seems like. :D |
Beta Was this translation helpful? Give feedback.
-
|
Hi Everyone, I'm running a distributed Cluster version 2.4.100 - upgraded and updates. I'm getting a rule missmatch for suricata - and for the love of god can't find the logs that point me to the cause. ElastAlert: OK 024-09-23T06:56:40.043586923Z","message":"Handled request"} this is the output for the so-rule-update that seems to complete successfuly: |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
v.2.4.80 soup fixed the suricata migration failed problem it seems like. :D