Sigma alerts Disappearing

[Crimson1110]

Version

2.4.140

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

64

Storage for /

70

Storage for /nsm

325

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Good evening,

I am triggering the Sigma rule " Security Privileges Enumeration Via Whoami.EXE" manually and it appears as an Alert. But however it disappears on the next run of the the query as far as I from the "elastalert.log".

There are some strange errors on the log file for some other rules:

It is not listed on the acknowledged rules or I do not have any custom rules. Everything seems to be working as they are "green".

Any idea what could cause this?

Thank you.
Best regards.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[Crimson1110]

retention.... :|