Case Insensitive Search Options #14872
-
Version2.4.80 Installation MethodSecurity Onion ISO image Descriptionconfiguration Installation TypeStandalone Locationairgap Hardware SpecsExceeds minimum requirements CPU23 RAM64 Storage for /600G Storage for /nsm40T Network Traffic Collectiontap Network Traffic Speeds1Gbps to 10Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsNo, there are no additional clues DetailHello, I've noticed that when searching through the dashboards, queries appear to be case sensitive, for example, searching
Will return results, but searching
Will return no results. I wanted to check, was case insensitive searching ever supported on previous versions of Security Onion? Is there currently any way to make all index fields case insensitive globally? Or maybe a workaround that allows for more flexible searching? I'd really appreciate any guidance, thank you! Guidelines
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 2 replies
-
|
There is a long history around this issue. We believe that case-insensitive, wildcard search capabilities are important - this used to be feasible with custom elasticsearch analyzers. With some technical changes to the underlying Elastic stack, this was no longer possible. So we moved to using EQL for the Sigma/Elastalert rules which allows wildcard + case insensitivity via the query language. OQL (based on lucene) has limited support for this, though we are working on finding a better solution. |
Beta Was this translation helpful? Give feedback.
-
|
Understood, thank you for the explanation. |
Beta Was this translation helpful? Give feedback.
-
|
To be clear, |
Beta Was this translation helpful? Give feedback.
There is a long history around this issue. We believe that case-insensitive, wildcard search capabilities are important - this used to be feasible with custom elasticsearch analyzers. With some technical changes to the underlying Elastic stack, this was no longer possible. So we moved to using EQL for the Sigma/Elastalert rules which allows wildcard + case insensitivity via the query language. OQL (based on lucene) has limited support for this, though we are working on finding a better solution.