ETPRO Tune Detections missing

[xaar1982]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32

Storage for /

500 GB

Storage for /nsm

350 GB

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello,

I have some problems with tune detection entries. I'm using ETPRO rulesets. I had a lot of tuning entries, that suppressed false postives. I set them up using SOC portal and "Tuning" tab. Now they are all gone....I see information in ruleset history that System created one again ruleset but at the same time it deleted all my entries. Below screenshot. The only action i done was reboot hosts via Grid panel to update OS. Is that proper behaviour ? If yes how can I prevent it in future ?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[defensivedepth]

Did you change any other configuration of your system? Airgap? Swap from ETPRO to ETOPEN then back to ETPRO?

[xaar1982]

Nope, the only thing I did was reboot machines due OS upgrade from SOC GRID

[defensivedepth]

Click on the following, set the timeframe to 2 days within when all this happened, and let me know what types of logs are seeing.

---