Security Onion: 404 Errors in Alerts & Detections Tabs + Rule Mismatch in ElastAlert & Suricata

[NassosRossi]

Hi, I'm experiencing a few issues with Security Onion (installed from the Azure Marketplace):

1. Alerts Tab: When I try to "Open in details panel," I get a 404 error.
2. Detections Tab: Clicking "View" also results in a 404 error.
3. Rule Mismatch: Even though Strelka appears to be running fine, I see a "Rule Mismatch" error in both ElastAlert and Suricata.

I haven't made any modifications to the rules, nor have I added anything custom. Generally the /api/detection endpoint is throwing a 404 error.

System health checks appear normal, so I'm unsure what could be causing this.

SO-Version: 2.4.130

Any help would be greatly appreciated!

Thanks in advance!

[defensivedepth]

Hey there!

api/detection endpoint is throwing a 404 error.

Do you have a Pro license installed?

[NassosRossi]

Hi, thanks for the response!

I don't have a Pro license installed. Also, I’ve attached an image of what I see when I press "View" in the Detections tab. Let me know if you need any additional details.

Thanks!

[dougburks]

Hi, I'm experiencing a few issues with Security Onion (installed from the Azure Marketplace):

Just to be clear, you installed from here?
https://azuremarketplace.microsoft.com/en-us/marketplace/apps/securityonionsolutions.securityonion?tab=Overview

and you followed our Azure documentation here?
https://docs.securityonion.net/en/2.4/cloud-azure.html

What are the specs of your Azure machine?

What browser are you using?

Have you checked the logs in /opt/so/log/ for additional clues?

SO-Version: 2.4.130

Was this a fresh installation of 2.4.130 or did you upgrade from a previous version?

[dougburks]

Upgrade Info: It was originally installed as version 2.4.120 and then upgraded to 2.4.130 using soup, as suggested in the documentation.

Did you have the same issues in 2.4.120?

Also, in order to view an alert or detection info, do we need a Pro license?

No, you should be able to view alert or detection info without a Pro license.

Is there a proxy or anything else between your browser and the Azure instance that may be interfering with the network traffic?

Do you have any browser plugins that might be interfering?

Have you tried an incognito window?

Have you tried a fresh installation of Chromium?

Have you tried accessing from a different computer?

Have you tried accessing from a different network?

From suricata.log:

[11 - Suricata-Main] 2025-03-21 11:02:04 Error: detect: Complete IP space negated. Rule address range is NIL. Probably have a !any or an address range that supplies a NULL address range
[11 - Suricata-Main] 2025-03-21 11:02:04 Error: detect: error parsing signature "alert tcp !$HOME_NET any -> $HOME_NET 25 (msg:"ET INFO Inbound Frequent Emails - Possible Spambot Inbound";

What is the output of the following?

grep HOME_NET /opt/so/conf/suricata/suricata.yaml 

From suricata.log:

[11 - Suricata-Main] 2025-03-21 07:07:19 Error: detect: Complete IP space negated. Rule address range is NIL. Probably have a !any or an address range that supplies a NULL address range
[11 - Suricata-Main] 2025-03-21 07:07:19 Error: detect: error parsing signature "alert udp ![$SMTP_SERVERS,$DNS_SERVERS]

What is the output of the following?

grep SMTP_SERVERS /opt/so/conf/suricata/suricata.yaml 

[NassosRossi]

We had the same problems with version 2.4.120. Now, we did a fresh installation from the start with version 2.4.130, and everything is working fine.

The only issue we're facing now is that the grid disconnects every hour, but after some time, it reconnects on its own.

Any ideas on what could be causing this?

Thanks!

[dougburks]

We had the same problems with version 2.4.120. Now, we did a fresh installation from the start with version 2.4.130, and everything is working fine.

Glad it's working correctly now!

The only issue we're facing now is that the grid disconnects every hour, but after some time, it reconnects on its own.
Any ideas on what could be causing this?

Are you perhaps using some kind of VPN connection?

Also, the questions from my previous response might be helpful:

Is there a proxy or anything else between your browser and the Azure instance that may be interfering with the network traffic?

Do you have any browser plugins that might be interfering?

Have you tried an incognito window?

Have you tried a fresh installation of Chromium?

Have you tried accessing from a different computer?

Have you tried accessing from a different network?

[NassosRossi]

Hi, thanks for following up!

We’ve tested accessing Security Onion from different computers, on different networks, and using different browsers. The issue persists across all of them.

We are using Cloudflare with a Full Strict policy, so there is a reverse proxy in place from Cloudflare.

Could this be affecting the grid connectivity?

Thanks!

[dougburks]

Have you tried testing without the reverse proxy?