Standalone instance not showing up on Grid but is a member

[ryantxu1]

Version

2.4.111

Installation Method

Cloud image (Amazon, Azure, Google)

Description

installation

Installation Type

Standalone

Location

cloud

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

64

Storage for /

512

Storage for /nsm

512

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I launched the SO AMI from AWS and set it up. What I'm encountering now is that even though I see the host as an accepted member, the grid page on the soc shows no data.

I checked the logs and didn't notice anything helpful about the grid. Any guidance on how to troubleshoot would be appreciated.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[rh-ops]

Try restarting SOC with sudo so-soc-restart.

[ryantxu1]

Didn't help unfortunately

[onion@securityonion-th ~]$ sudo so-soc-restart
=========================================================================
Restarting soc...

This could take a while if another Salt job is running.
Run this command with --force to stop all Salt jobs before proceeding.
=========================================================================
so-soc
so-soc
[INFO    ] Loading fresh modules for state activity
[INFO    ] Running state [/opt/so/saltstack/local/pillar/elasticsearch/auth.sls] at time 19:51:17.627672
[INFO    ] Executing state file.managed for [/opt/so/saltstack/local/pillar/elasticsearch/auth.sls]
[INFO    ] File /opt/so/saltstack/local/pillar/elasticsearch/auth.sls is in the correct state
[INFO    ] Completed state [/opt/so/saltstack/local/pillar/elasticsearch/auth.sls] at time 19:51:20.845491 (duration_in_ms=3217.82)
[INFO    ] Running state [kratos] at time 19:51:20.846695
[INFO    ] Executing state group.present for [kratos]
[INFO    ] Group kratos is present and up to date
[INFO    ] Completed state [kratos] at time 19:51:20.850512 (duration_in_ms=3.817)
[INFO    ] Running state [kratos] at time 19:51:20.851028
[INFO    ] Executing state user.present for [kratos]
[INFO    ] User kratos is present and up to date
[INFO    ] Completed state [kratos] at time 19:51:20.858601 (duration_in_ms=7.573)
[INFO    ] Running state [/nsm/kratos] at time 19:51:20.858776
[INFO    ] Executing state file.directory for [/nsm/kratos]
[INFO    ] The directory /nsm/kratos is in the correct state
[INFO    ] Completed state [/nsm/kratos] at time 19:51:20.859886 (duration_in_ms=1.11)
[INFO    ] Running state [/nsm/kratos/db] at time 19:51:20.860064
[INFO    ] Executing state file.directory for [/nsm/kratos/db]
[INFO    ] The directory /nsm/kratos/db is in the correct state
[INFO    ] Completed state [/nsm/kratos/db] at time 19:51:20.861237 (duration_in_ms=1.174)
[INFO    ] Running state [/opt/so/log/kratos] at time 19:51:20.861401
[INFO    ] Executing state file.directory for [/opt/so/log/kratos]
[INFO    ] The directory /opt/so/log/kratos is in the correct state
[INFO    ] Completed state [/opt/so/log/kratos] at time 19:51:20.862423 (duration_in_ms=1.023)
[INFO    ] Running state [/opt/so/conf/kratos/schema.json] at time 19:51:20.862618
[INFO    ] Executing state file.managed for [/opt/so/conf/kratos/schema.json]
[INFO    ] File /opt/so/conf/kratos/schema.json is in the correct state
[INFO    ] Completed state [/opt/so/conf/kratos/schema.json] at time 19:51:20.871854 (duration_in_ms=9.236)
[INFO    ] Running state [/opt/so/conf/kratos/oidc.jsonnet] at time 19:51:20.872031
[INFO    ] Executing state file.managed for [/opt/so/conf/kratos/oidc.jsonnet]
[INFO    ] File /opt/so/conf/kratos/oidc.jsonnet is in the correct state
[INFO    ] Completed state [/opt/so/conf/kratos/oidc.jsonnet] at time 19:51:20.880314 (duration_in_ms=8.284)
[INFO    ] Running state [/opt/so/conf/kratos/kratos.yaml] at time 19:51:20.880511
[INFO    ] Executing state file.managed for [/opt/so/conf/kratos/kratos.yaml]
[INFO    ] File /opt/so/conf/kratos/kratos.yaml is in the correct state
[INFO    ] Completed state [/opt/so/conf/kratos/kratos.yaml] at time 19:51:20.894515 (duration_in_ms=14.005)
[INFO    ] Running state [/opt/so/conf/so-status/so-status.conf] at time 19:51:20.894692
[INFO    ] Executing state file.append for [/opt/so/conf/so-status/so-status.conf]
/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/psutil_compat.py:16: DeprecationWarning: Please stop importing 'salt.utils.psutil_compat' and instead import 'psutil' directly as there's no longer a need for a compatability layer. The 'salt.utils.psutil_compat' will go away on Salt 3008.0 (Argon).
  salt.utils.versions.warn_until(
[INFO    ] Executing command git in directory '/root'
[INFO    ] Executing command 'grep' in directory '/root'
[INFO    ] ['unless condition is true']
[INFO    ] Completed state [/opt/so/conf/so-status/so-status.conf] at time 19:51:21.840911 (duration_in_ms=946.219)
[INFO    ] Running state [so-kratos] at time 19:51:21.842051
[INFO    ] Executing state docker_container.running for [so-kratos]
[INFO    ] Container 'so-kratos' is already configured as specified
[INFO    ] Completed state [so-kratos] at time 19:51:23.247178 (duration_in_ms=1405.127)
[INFO    ] Running state [/opt/so/conf/so-status/so-status.conf] at time 19:51:23.247402
[INFO    ] Executing state file.uncomment for [/opt/so/conf/so-status/so-status.conf]
[INFO    ] Pattern already uncommented
[INFO    ] Completed state [/opt/so/conf/so-status/so-status.conf] at time 19:51:23.249799 (duration_in_ms=2.396)
[INFO    ] Running state [http://securityonion-th:4434/] at time 19:51:23.250221
[INFO    ] Executing state http.wait_for_successful_query for [http://securityonion-th:4434/]
[INFO    ] Status 404 was found.
[INFO    ] Completed state [http://securityonion-th:4434/] at time 19:51:23.256324 (duration_in_ms=6.103)
[INFO    ] Running state [/var/tmp/so-user.lock] at time 19:51:23.256543
[INFO    ] Executing state file.missing for [/var/tmp/so-user.lock]
[INFO    ] Path /var/tmp/so-user.lock is missing
[INFO    ] Completed state [/var/tmp/so-user.lock] at time 19:51:23.257230 (duration_in_ms=0.686)
[INFO    ] Running state [so-user sync] at time 19:51:23.257915
[INFO    ] Executing state cmd.run for [so-user sync]
[INFO    ] ['All files in creates exist']
[INFO    ] Completed state [so-user sync] at time 19:51:23.263673 (duration_in_ms=5.757)
[INFO    ] Running state [PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin /usr/sbin/so-user sync &>> /opt/so/log/soc/sync.log] at time 19:51:23.263861
[INFO    ] Executing state cron.present for [PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin /usr/sbin/so-user sync &>> /opt/so/log/soc/sync.log]
[INFO    ] Executing command 'grep' in directory '/root'
[INFO    ] Executing command 'crontab' in directory '/root'
[INFO    ] Cron PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin /usr/sbin/so-user sync &>> /opt/so/log/soc/sync.log already present
[INFO    ] Completed state [PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin /usr/sbin/so-user sync &>> /opt/so/log/soc/sync.log] at time 19:51:23.276862 (duration_in_ms=13.0)
[INFO    ] Running state [/opt/so/conf/sigma/repos] at time 19:51:23.277086
[INFO    ] Executing state file.directory for [/opt/so/conf/sigma/repos]
[INFO    ] The directory /opt/so/conf/sigma/repos is in the correct state
[INFO    ] Completed state [/opt/so/conf/sigma/repos] at time 19:51:23.278255 (duration_in_ms=1.17)
[INFO    ] Running state [/opt/so/rules/elastalert/rules] at time 19:51:23.278401
[INFO    ] Executing state file.directory for [/opt/so/rules/elastalert/rules]
[INFO    ] The directory /opt/so/rules/elastalert/rules is in the correct state
[INFO    ] Completed state [/opt/so/rules/elastalert/rules] at time 19:51:23.279379 (duration_in_ms=0.978)
[INFO    ] Running state [/opt/so/conf/soc/fingerprints] at time 19:51:23.279591
[INFO    ] Executing state file.directory for [/opt/so/conf/soc/fingerprints]
[INFO    ] The directory /opt/so/conf/soc/fingerprints is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/fingerprints] at time 19:51:23.280653 (duration_in_ms=1.062)
[INFO    ] Running state [/nsm/soc/jobs] at time 19:51:23.280797
[INFO    ] Executing state file.directory for [/nsm/soc/jobs]
[INFO    ] The directory /nsm/soc/jobs is in the correct state
[INFO    ] Completed state [/nsm/soc/jobs] at time 19:51:23.281757 (duration_in_ms=0.96)
[INFO    ] Running state [/opt/so/log/soc] at time 19:51:23.281897
[INFO    ] Executing state file.directory for [/opt/so/log/soc]
[INFO    ] The directory /opt/so/log/soc is in the correct state
[INFO    ] Completed state [/opt/so/log/soc] at time 19:51:23.283050 (duration_in_ms=1.152)
[INFO    ] Running state [/opt/so/conf/soc/queue] at time 19:51:23.283198
[INFO    ] Executing state file.directory for [/opt/so/conf/soc/queue]
[INFO    ] The directory /opt/so/conf/soc/queue is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/queue] at time 19:51:23.284188 (duration_in_ms=0.99)
[INFO    ] Running state [/opt/so/conf/soc/analytics.js] at time 19:51:23.284331
[INFO    ] Executing state file.managed for [/opt/so/conf/soc/analytics.js]
[INFO    ] File /opt/so/conf/soc/analytics.js is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/analytics.js] at time 19:51:23.294192 (duration_in_ms=9.86)
[INFO    ] Running state [/opt/so/conf/soc/soc.json] at time 19:51:23.294366
[INFO    ] Executing state file.managed for [/opt/so/conf/soc/soc.json]
[INFO    ] File /opt/so/conf/soc/soc.json is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/soc.json] at time 19:51:25.173928 (duration_in_ms=1879.562)
[INFO    ] Running state [/opt/so/conf/soc/motd.md] at time 19:51:25.174110
[INFO    ] Executing state file.managed for [/opt/so/conf/soc/motd.md]
[INFO    ] File /opt/so/conf/soc/motd.md is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/motd.md] at time 19:51:25.184064 (duration_in_ms=9.954)
[INFO    ] Running state [/opt/so/conf/soc/so-detections-backup.py] at time 19:51:25.184221
[INFO    ] Executing state file.managed for [/opt/so/conf/soc/so-detections-backup.py]
[INFO    ] File /opt/so/conf/soc/so-detections-backup.py is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/so-detections-backup.py] at time 19:51:25.191934 (duration_in_ms=7.714)
[INFO    ] Running state [/usr/sbin/so-detections-runtime-status cron] at time 19:51:25.192090
[INFO    ] Executing state cron.present for [/usr/sbin/so-detections-runtime-status cron]
[INFO    ] Executing command 'crontab' in directory '/root'
[INFO    ] Cron /usr/sbin/so-detections-runtime-status cron already present
[INFO    ] Completed state [/usr/sbin/so-detections-runtime-status cron] at time 19:51:25.196006 (duration_in_ms=3.915)
[INFO    ] Running state [python3 /opt/so/conf/soc/so-detections-backup.py &>> /opt/so/log/soc/detections-backup.log] at time 19:51:25.196226
[INFO    ] Executing state cron.present for [python3 /opt/so/conf/soc/so-detections-backup.py &>> /opt/so/log/soc/detections-backup.log]
[INFO    ] Executing command 'crontab' in directory '/root'
[INFO    ] Cron python3 /opt/so/conf/soc/so-detections-backup.py &>> /opt/so/log/soc/detections-backup.log already present
[INFO    ] Completed state [python3 /opt/so/conf/soc/so-detections-backup.py &>> /opt/so/log/soc/detections-backup.log] at time 19:51:25.200158 (duration_in_ms=3.932)
[INFO    ] Running state [/opt/so/conf/soc/sigma_final_pipeline.yaml] at time 19:51:25.200356
[INFO    ] Executing state file.managed for [/opt/so/conf/soc/sigma_final_pipeline.yaml]
[INFO    ] File /opt/so/conf/soc/sigma_final_pipeline.yaml is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/sigma_final_pipeline.yaml] at time 19:51:25.208964 (duration_in_ms=8.609)
[INFO    ] Running state [/opt/so/conf/soc/sigma_so_pipeline.yaml] at time 19:51:25.209130
[INFO    ] Executing state file.managed for [/opt/so/conf/soc/sigma_so_pipeline.yaml]
[INFO    ] File /opt/so/conf/soc/sigma_so_pipeline.yaml is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/sigma_so_pipeline.yaml] at time 19:51:25.216934 (duration_in_ms=7.804)
[INFO    ] Running state [/opt/so/conf/soc/banner.md] at time 19:51:25.217090
[INFO    ] Executing state file.managed for [/opt/so/conf/soc/banner.md]
[INFO    ] File /opt/so/conf/soc/banner.md is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/banner.md] at time 19:51:25.225750 (duration_in_ms=8.66)
[INFO    ] Running state [/usr/sbin] at time 19:51:25.225903
[INFO    ] Executing state file.recurse for [/usr/sbin]
[INFO    ] {'/usr/sbin': {'/usr/sbin': {'user': 939}, 'user': 939}}
[INFO    ] Loading fresh modules for state activity
[INFO    ] Completed state [/usr/sbin] at time 19:51:25.335878 (duration_in_ms=109.974)
[INFO    ] Running state [/opt/so/conf/soc/custom.js] at time 19:51:25.337594
[INFO    ] Executing state file.managed for [/opt/so/conf/soc/custom.js]
[INFO    ] File /opt/so/conf/soc/custom.js is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/custom.js] at time 19:51:25.349745 (duration_in_ms=12.152)
[INFO    ] Running state [/opt/so/conf/soc/custom_roles] at time 19:51:25.349929
[INFO    ] Executing state file.managed for [/opt/so/conf/soc/custom_roles]
[INFO    ] File /opt/so/conf/soc/custom_roles is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/custom_roles] at time 19:51:25.359549 (duration_in_ms=9.619)
[INFO    ] Running state [/opt/so/conf/soc/soc_users_roles] at time 19:51:25.359821
[INFO    ] Executing state file.exists for [/opt/so/conf/soc/soc_users_roles]
[INFO    ] Path /opt/so/conf/soc/soc_users_roles exists
[INFO    ] Completed state [/opt/so/conf/soc/soc_users_roles] at time 19:51:25.360451 (duration_in_ms=0.631)
[INFO    ] Running state [/nsm/soc/uploads] at time 19:51:25.360622
[INFO    ] Executing state file.directory for [/nsm/soc/uploads]
[INFO    ] The directory /nsm/soc/uploads is in the correct state
[INFO    ] Completed state [/nsm/soc/uploads] at time 19:51:25.361620 (duration_in_ms=0.999)
[INFO    ] Running state [/opt/so/rules] at time 19:51:25.361767
[INFO    ] Executing state file.directory for [/opt/so/rules]
[INFO    ] The directory /opt/so/rules is in the correct state
[INFO    ] Completed state [/opt/so/rules] at time 19:51:25.362754 (duration_in_ms=0.987)
[INFO    ] Running state [/opt/so/conf/soc/ai_summary_repos] at time 19:51:25.362902
[INFO    ] Executing state file.directory for [/opt/so/conf/soc/ai_summary_repos]
[INFO    ] The directory /opt/so/conf/soc/ai_summary_repos is in the correct state
[INFO    ] Completed state [/opt/so/conf/soc/ai_summary_repos] at time 19:51:25.363929 (duration_in_ms=1.028)
[INFO    ] Running state [/opt/so/conf/so-status/so-status.conf] at time 19:51:25.364076
[INFO    ] Executing state file.append for [/opt/so/conf/so-status/so-status.conf]
/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/psutil_compat.py:16: DeprecationWarning: Please stop importing 'salt.utils.psutil_compat' and instead import 'psutil' directly as there's no longer a need for a compatability layer. The 'salt.utils.psutil_compat' will go away on Salt 3008.0 (Argon).
  salt.utils.versions.warn_until(
[INFO    ] Executing command 'grep' in directory '/root'
[INFO    ] ['unless condition is true']
[INFO    ] Completed state [/opt/so/conf/so-status/so-status.conf] at time 19:51:26.114477 (duration_in_ms=750.401)
[INFO    ] Running state [so-soc] at time 19:51:26.116385
[INFO    ] Executing state docker_container.running for [so-soc]
[INFO    ] {'container': {'Networks': {'bridge': {'IPConfiguration': {'old': 'automatic', 'new': 'not connected'}}, 'sobridge': {'IPAMConfig': {'old': None, 'new': {'IPv4Address': '172.17.1.34'}}}}}, 'container_id': {'added': '4d9fc33b787124e1bda1251b93553528a4034659b70e4cc6aa2720744247b542'}, 'state': {'old': None, 'new': 'running'}}
[INFO    ] Completed state [so-soc] at time 19:51:27.580922 (duration_in_ms=1464.537)
[INFO    ] Running state [/opt/so/conf/so-status/so-status.conf] at time 19:51:27.581157
[INFO    ] Executing state file.uncomment for [/opt/so/conf/so-status/so-status.conf]
[INFO    ] Pattern already uncommented
[INFO    ] Completed state [/opt/so/conf/so-status/so-status.conf] at time 19:51:27.583679 (duration_in_ms=2.521)
[INFO    ] Running state [/opt/so/saltstack/default/salt/soc/files/bin/salt-relay.sh &] at time 19:51:27.583840
[INFO    ] Executing state cron.present for [/opt/so/saltstack/default/salt/soc/files/bin/salt-relay.sh &]
[INFO    ] Executing command 'crontab' in directory '/root'
[INFO    ] Cron /opt/so/saltstack/default/salt/soc/files/bin/salt-relay.sh & already present
[INFO    ] Completed state [/opt/so/saltstack/default/salt/soc/files/bin/salt-relay.sh &] at time 19:51:27.588355 (duration_in_ms=4.515)
local:
----------
          ID: elastic_auth_pillar
    Function: file.managed
        Name: /opt/so/saltstack/local/pillar/elasticsearch/auth.sls
      Result: True
     Comment: File /opt/so/saltstack/local/pillar/elasticsearch/auth.sls is in the correct state
     Started: 19:51:17.627671
    Duration: 3217.82 ms
     Changes:
----------
          ID: kratosgroup
    Function: group.present
        Name: kratos
      Result: True
     Comment: Group kratos is present and up to date
     Started: 19:51:20.846695
    Duration: 3.817 ms
     Changes:
----------
          ID: kratos
    Function: user.present
      Result: True
     Comment: User kratos is present and up to date
     Started: 19:51:20.851028
    Duration: 7.573 ms
     Changes:
----------
          ID: kratosdir
    Function: file.directory
        Name: /nsm/kratos
      Result: True
     Comment: The directory /nsm/kratos is in the correct state
     Started: 19:51:20.858776
    Duration: 1.11 ms
     Changes:
----------
          ID: kratosdbdir
    Function: file.directory
        Name: /nsm/kratos/db
      Result: True
     Comment: The directory /nsm/kratos/db is in the correct state
     Started: 19:51:20.860063
    Duration: 1.174 ms
     Changes:
----------
          ID: kratoslogdir
    Function: file.directory
        Name: /opt/so/log/kratos
      Result: True
     Comment: The directory /opt/so/log/kratos is in the correct state
     Started: 19:51:20.861400
    Duration: 1.023 ms
     Changes:
----------
          ID: kratosschema
    Function: file.managed
        Name: /opt/so/conf/kratos/schema.json
      Result: True
     Comment: File /opt/so/conf/kratos/schema.json is in the correct state
     Started: 19:51:20.862618
    Duration: 9.236 ms
     Changes:
----------
          ID: kratosoidc
    Function: file.managed
        Name: /opt/so/conf/kratos/oidc.jsonnet
      Result: True
     Comment: File /opt/so/conf/kratos/oidc.jsonnet is in the correct state
     Started: 19:51:20.872030
    Duration: 8.284 ms
     Changes:
----------
          ID: kratosconfig
    Function: file.managed
        Name: /opt/so/conf/kratos/kratos.yaml
      Result: True
     Comment: File /opt/so/conf/kratos/kratos.yaml is in the correct state
     Started: 19:51:20.880510
    Duration: 14.005 ms
     Changes:
----------
          ID: append_so-kratos_so-status.conf
    Function: file.append
        Name: /opt/so/conf/so-status/so-status.conf
      Result: True
     Comment: unless condition is true
     Started: 19:51:20.894692
    Duration: 946.219 ms
     Changes:
----------
          ID: so-kratos
    Function: docker_container.running
      Result: True
     Comment: Container 'so-kratos' is already configured as specified
     Started: 19:51:21.842051
    Duration: 1405.127 ms
     Changes:
----------
          ID: delete_so-kratos_so-status.disabled
    Function: file.uncomment
        Name: /opt/so/conf/so-status/so-status.conf
      Result: True
     Comment: Pattern already uncommented
     Started: 19:51:23.247403
    Duration: 2.396 ms
     Changes:
----------
          ID: wait_for_kratos
    Function: http.wait_for_successful_query
        Name: http://securityonion-th:4434/
      Result: True
     Comment: Status 404 was found.
                status: 404
                error: HTTP 404: Not Found
                body: 404 page not found

     Started: 19:51:23.250221
    Duration: 6.103 ms
     Changes:
----------
          ID: so-user.lock
    Function: file.missing
        Name: /var/tmp/so-user.lock
      Result: True
     Comment: Path /var/tmp/so-user.lock is missing
     Started: 19:51:23.256544
    Duration: 0.686 ms
     Changes:
----------
          ID: sync_es_users
    Function: cmd.run
        Name: so-user sync
      Result: True
     Comment: All files in creates exist
     Started: 19:51:23.257916
    Duration: 5.757 ms
     Changes:
----------
          ID: so-user_sync
    Function: cron.present
        Name: PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin /usr/sbin/so-user sync &>> /opt/so/log/soc/sync.log
      Result: True
     Comment: Cron PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin /usr/sbin/so-user sync &>> /opt/so/log/soc/sync.log already present
     Started: 19:51:23.263862
    Duration: 13.0 ms
     Changes:
----------
          ID: sigmarepodir
    Function: file.directory
        Name: /opt/so/conf/sigma/repos
      Result: True
     Comment: The directory /opt/so/conf/sigma/repos is in the correct state
     Started: 19:51:23.277085
    Duration: 1.17 ms
     Changes:
----------
          ID: socdirelastaertrules
    Function: file.directory
        Name: /opt/so/rules/elastalert/rules
      Result: True
     Comment: The directory /opt/so/rules/elastalert/rules is in the correct state
     Started: 19:51:23.278401
    Duration: 0.978 ms
     Changes:
----------
          ID: socdir
    Function: file.directory
        Name: /opt/so/conf/soc/fingerprints
      Result: True
     Comment: The directory /opt/so/conf/soc/fingerprints is in the correct state
     Started: 19:51:23.279591
    Duration: 1.062 ms
     Changes:
----------
          ID: socdatadir
    Function: file.directory
        Name: /nsm/soc/jobs
      Result: True
     Comment: The directory /nsm/soc/jobs is in the correct state
     Started: 19:51:23.280797
    Duration: 0.96 ms
     Changes:
----------
          ID: soclogdir
    Function: file.directory
        Name: /opt/so/log/soc
      Result: True
     Comment: The directory /opt/so/log/soc is in the correct state
     Started: 19:51:23.281898
    Duration: 1.152 ms
     Changes:
----------
          ID: socsaltdir
    Function: file.directory
        Name: /opt/so/conf/soc/queue
      Result: True
     Comment: The directory /opt/so/conf/soc/queue is in the correct state
     Started: 19:51:23.283198
    Duration: 0.99 ms
     Changes:
----------
          ID: socanalytics
    Function: file.managed
        Name: /opt/so/conf/soc/analytics.js
      Result: True
     Comment: File /opt/so/conf/soc/analytics.js is in the correct state
     Started: 19:51:23.284332
    Duration: 9.86 ms
     Changes:
----------
          ID: socconfig
    Function: file.managed
        Name: /opt/so/conf/soc/soc.json
      Result: True
     Comment: File /opt/so/conf/soc/soc.json is in the correct state
     Started: 19:51:23.294366
    Duration: 1879.562 ms
     Changes:
----------
          ID: socmotd
    Function: file.managed
        Name: /opt/so/conf/soc/motd.md
      Result: True
     Comment: File /opt/so/conf/soc/motd.md is in the correct state
     Started: 19:51:25.174110
    Duration: 9.954 ms
     Changes:
----------
          ID: filedetectionsbackup
    Function: file.managed
        Name: /opt/so/conf/soc/so-detections-backup.py
      Result: True
     Comment: File /opt/so/conf/soc/so-detections-backup.py is in the correct state
     Started: 19:51:25.184220
    Duration: 7.714 ms
     Changes:
----------
          ID: crondetectionsruntime
    Function: cron.present
        Name: /usr/sbin/so-detections-runtime-status cron
      Result: True
     Comment: Cron /usr/sbin/so-detections-runtime-status cron already present
     Started: 19:51:25.192091
    Duration: 3.915 ms
     Changes:
----------
          ID: crondetectionsbackup
    Function: cron.present
        Name: python3 /opt/so/conf/soc/so-detections-backup.py &>> /opt/so/log/soc/detections-backup.log
      Result: True
     Comment: Cron python3 /opt/so/conf/soc/so-detections-backup.py &>> /opt/so/log/soc/detections-backup.log already present
     Started: 19:51:25.196226
    Duration: 3.932 ms
     Changes:
----------
          ID: socsigmafinalpipeline
    Function: file.managed
        Name: /opt/so/conf/soc/sigma_final_pipeline.yaml
      Result: True
     Comment: File /opt/so/conf/soc/sigma_final_pipeline.yaml is in the correct state
     Started: 19:51:25.200355
    Duration: 8.609 ms
     Changes:
----------
          ID: socsigmasopipeline
    Function: file.managed
        Name: /opt/so/conf/soc/sigma_so_pipeline.yaml
      Result: True
     Comment: File /opt/so/conf/soc/sigma_so_pipeline.yaml is in the correct state
     Started: 19:51:25.209130
    Duration: 7.804 ms
     Changes:
----------
          ID: socbanner
    Function: file.managed
        Name: /opt/so/conf/soc/banner.md
      Result: True
     Comment: File /opt/so/conf/soc/banner.md is in the correct state
     Started: 19:51:25.217090
    Duration: 8.66 ms
     Changes:
----------
          ID: soc_sbin
    Function: file.recurse
        Name: /usr/sbin
      Result: True
     Comment: Recursively updated /usr/sbin
     Started: 19:51:25.225904
    Duration: 109.974 ms
     Changes:
              ----------
              /usr/sbin:
                  ----------
                  /usr/sbin:
                      ----------
                      user:
                          939
                  user:
                      939
----------
          ID: soccustom
    Function: file.managed
        Name: /opt/so/conf/soc/custom.js
      Result: True
     Comment: File /opt/so/conf/soc/custom.js is in the correct state
     Started: 19:51:25.337593
    Duration: 12.152 ms
     Changes:
----------
          ID: soccustomroles
    Function: file.managed
        Name: /opt/so/conf/soc/custom_roles
      Result: True
     Comment: File /opt/so/conf/soc/custom_roles is in the correct state
     Started: 19:51:25.349930
    Duration: 9.619 ms
     Changes:
----------
          ID: socusersroles
    Function: file.exists
        Name: /opt/so/conf/soc/soc_users_roles
      Result: True
     Comment: Path /opt/so/conf/soc/soc_users_roles exists
     Started: 19:51:25.359820
    Duration: 0.631 ms
     Changes:
----------
          ID: socuploaddir
    Function: file.directory
        Name: /nsm/soc/uploads
      Result: True
     Comment: The directory /nsm/soc/uploads is in the correct state
     Started: 19:51:25.360621
    Duration: 0.999 ms
     Changes:
----------
          ID: socsigmarepo
    Function: file.directory
        Name: /opt/so/rules
      Result: True
     Comment: The directory /opt/so/rules is in the correct state
     Started: 19:51:25.361767
    Duration: 0.987 ms
     Changes:
----------
          ID: socsensoronirepos
    Function: file.directory
        Name: /opt/so/conf/soc/ai_summary_repos
      Result: True
     Comment: The directory /opt/so/conf/soc/ai_summary_repos is in the correct state
     Started: 19:51:25.362901
    Duration: 1.028 ms
     Changes:
----------
          ID: append_so-soc_so-status.conf
    Function: file.append
        Name: /opt/so/conf/so-status/so-status.conf
      Result: True
     Comment: unless condition is true
     Started: 19:51:25.364076
    Duration: 750.401 ms
     Changes:
----------
          ID: so-soc
    Function: docker_container.running
      Result: True
     Comment: Created container 'so-soc'
     Started: 19:51:26.116385
    Duration: 1464.537 ms
     Changes:
              ----------
              container:
                  ----------
                  Networks:
                      ----------
                      bridge:
                          ----------
                          IPConfiguration:
                              ----------
                              new:
                                  not connected
                              old:
                                  automatic
                      sobridge:
                          ----------
                          IPAMConfig:
                              ----------
                              new:
                                  ----------
                                  IPv4Address:
                                      172.17.1.34
                              old:
                                  None
              container_id:
                  ----------
                  added:
                      4d9fc33b787124e1bda1251b93553528a4034659b70e4cc6aa2720744247b542
              state:
                  ----------
                  new:
                      running
                  old:
                      None
----------
          ID: delete_so-soc_so-status.disabled
    Function: file.uncomment
        Name: /opt/so/conf/so-status/so-status.conf
      Result: True
     Comment: Pattern already uncommented
     Started: 19:51:27.581158
    Duration: 2.521 ms
     Changes:
----------
          ID: salt-relay
    Function: cron.present
        Name: /opt/so/saltstack/default/salt/soc/files/bin/salt-relay.sh &
      Result: True
     Comment: Cron /opt/so/saltstack/default/salt/soc/files/bin/salt-relay.sh & already present
     Started: 19:51:27.583840
    Duration: 4.515 ms
     Changes:

Summary for local
-------------
Succeeded: 42 (changed=2)
Failed:     0
-------------
Total states run:     42
Total run time:    9.947 s

[philcoau]

Hey I was monitoring this post as I had the exact same issue,

Managed to get mine working today. Simple fix, turned out since i was using a custom FQDN hostname that i had setup internally on my local Domain Controller DNS with associated A records to resolve to the Internal IP of the SO install.
i could resolve the FQDN internally (but not externally) and reach the analyst pages.

however that standalone instance i had installed was setup to use google dns 8.8.8.8 8.8.4.4.
I changed dns to use my local DNS server rebooted and it is now in the grid.

via ssh
sudo -i
nmtui
change the dns server on the management interface
tab to 'OK' to Save. Esc back to main and Quit.
Reboot from console.

wait for analyst page to be available and check grid.