Playbook Alerts

[Bigelow-Brown]

• Security Onion version: 2.4.80
• Is this a cloud deployment or on-prem? On Prem w/internet access
• Did you install from our Security Onion ISO image or did you perform a network installation? I don’t know
• If network installation, what distro and version did you install on?
• How many nodes do you have? 1
• What are the hardware specs of each of those nodes? I don’t know
• How are each of those nodes configured? (ex. manager with 2 search nodes and 3 forward nodes)
• Are you experiencing issues monitoring network traffic? No
• Does so-status show all services running? Yes
• Do you get any failures when you run sudo salt-call state.highstate? No
• Does the SOC Grid page show any failures? No
• Explain your issue:

I just inherited a standalone install of Security Onion and I am new to the platform so bear with me… From what I have discovered playbook was replaced with Detections, however under Alerts I see several alerts have been triggered with event.module: playbook. If I try to click on the rule name, the Tune Detection option is greyed out, and if I try to find the alert in Detections they are not there. I can use the Tune Detection option for suricata alerts and I can see lots of suricata, yara, and sigma rules under Detections. Am I missing something here?

UPDATE I found the YAML files for these alerts on the server, can/should I edit those files to suppress/filter the alerts for false positives?

[cm-ops]

Check /nsm/backup/detections-migration/ to see if the rules were backed up in the upgrade to/past 2.4.70 that includes Detections. The old Playbook rules should have been backed up and removed.

[Bigelow-Brown]

Thanks for the reply! It looks like the old rules were not backed up and removed. The /nsmbackup/detections-migration/sigma/rules folder is empty, and the /opt/so/rules/elastalert/playbook folder has all of the .yaml files in it still.

After seeing your response I found another thread where someone else had the same issue and manually backed up/removed the playbook files. Is this the best way forward?

sudo cp /opt/so/rules/elastalert/playbook/* /nsm/backup/detections-migration/sigma/rules/
sudo rm /opt/so/rules/elastalert/playbook/*

[cm-ops]

It is, that is what the soup script pretty much did when upgraded to 2.4.70.