How to remove old alert from Local.rules file

[YvesEutelsat]

Version

2.4.70

Installation Method

Security Onion ISO image

Description

upgrading

Installation Type

Standalone

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

128G

Storage for /

1T

Storage for /nsm

350M

Network Traffic Collection

tap

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

Good day,

I upgraded Security Onion 2.4.50 to 2.4.70. I had some rules written in the "Local.rules" file. Now with the Detection interface, i'm trying to delete those rules that I wrote but not success. I can't find those rules within the Detection Interface. I tried to delete them directly in the Local.rules file but they keep re-appearing in the file.

Reading the manual, it seems disabling/editing/deleting should be done in the Detection Interface, but I can't find those rules.

Any assistance would be much appreciated

Thanks

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.