Replies: 2 comments 7 replies
-
|
Looks like there are a bunch of rules deployed but not enabled. What does your idstools pillar look like? |
Beta Was this translation helpful? Give feedback.
-
|
I've searched several logs in /opt/so/log for any helpful clues, but nothing found other what I've previously listed. Performing a query using valid keyword(s) in the Detections tab returns nothing. In the Alerts tab, selecting an alert item, the selection menu "Tune Detection" is greyed out. Is there a setting in Administration > Configuration that I check to make sure it's enabled for Detections? Is there a configuration file and contents I can verify for Detections? |
Beta Was this translation helpful? Give feedback.
-
|
Look in /opt/so/log/soc/sensoroni-server.log for Detections. Your pillar looks like it is missing disabled and enabled. Like below: |
Beta Was this translation helpful? Give feedback.
-
|
Added enabled: and disabled: to /opt/so/saltstack/local/pillar/idstools/soc_idstools.sls salt-call state.highstateno errors waited about 30 minutes, checked Detections tab, still shows "Rule Mismatch". Checked the /opt/so/log/soc/sensoroni-server.log for detection errors, found same/similar as previously described. Does "44331" mean I need to manually add all those SIDs to the enabled: section in the .sls config file for Detections tab to start working again? so-rule-update2025-08-27 16:00:45,281 - - This is idstools-rulecat version 0.6.5; Python: 3.13.3 (main, May 21 2025, 23:35:07) [GCC 12.2.0] |
Beta Was this translation helpful? Give feedback.
-
|
Would you let me know what this shows? |
Beta Was this translation helpful? Give feedback.
-
|
Thanks Chris for continued troubleshooting.
This is the full output
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size |
Beta Was this translation helpful? Give feedback.
-
|
I added missing indices: so-detection and so-detectionhistory
In Kibana I see the below error. Do I need to populate a field? and with what? Lifecycle error: Current phase definition: "lifecycle": { |
Beta Was this translation helpful? Give feedback.
-
|
Doesn't look the rules have made it to the index. Did you just run a PUT to create the index? Try this, remove both If there are these files in /opt/so/conf/soc/fingerprint/ Restart SOC with |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Version
2.4.170
Installation Method
Security Onion ISO image
Description
other (please provide detail below)
Installation Type
Distributed
Location
on-prem with Internet access
Hardware Specs
Exceeds minimum requirements
CPU
Manager: 8 CPU
RAM
Manager: 32 GB
Storage for /
82 GB total, 29 GB available
Storage for /nsm
159 GB total, 57 GB available
Network Traffic Collection
tap
Network Traffic Speeds
1Gbps to 10Gbps
Status
Yes, all services on all nodes are running OK
Salt Status
No, there are no failures
Logs
Yes, there are additional clues in /opt/so/log/ (please provide detail below)
Detail
All grid (manager, search, and sensor) node's services are showing green "Running".
Detections tab:
"Total Found: 0"
ElastAlert: Rule Mismatch
Strelka: Rule Mismatch
Suricata: Rule Mismatch
Clicking Options, Suricata "Full Update"
tail -f /opt/so/log/soc/sensoroni-server.log | grep -i suricata
--snip--
{"fields":{"detectionEngine":"suricata","error":"state file present but 0 community rules found","syncDuration":46.940566969,"syncId":"03c831b2-e4b4-4a46-8810-43bf30a12b0e"},"level":"info","timestamp":"2025-08-21T15:44:03.245670391Z","message":"sync completed"}
--snip--
{"fields":{"deployedFilteredOutCount":0,"detectionEngine":"suricata","enabledFilteredOutCount":0,"intCheckId":"af1d9770-2fc3-4eca-92e2-4b857ccccc92","rangesToIgnore":[{"LowerLimit":1100000,"UpperLimit":1101000}]},"level":"info","timestamp":"2025-08-21T15:44:13.324013034Z","message":"ignoring SIDs"}
{"fields":{"deployedButNotEnabled":["2059683","2051427","2034852","2022174","2061261","2014919","2035209","2046121","2048507","2049018","2023775","2032336","2010008","2022472","2403387","2017446","2025288","2101244","2048893","2048406"],"deployedButNotEnabledCount":44331,"detectionEngine":"suricata","enabledButNotDeployed":[],"enabledButNotDeployedCount":0,"intCheckId":"af1d9770-2fc3-4eca-92e2-4b857ccccc92"},"level":"warn","timestamp":"2025-08-21T15:44:13.340228569Z","message":"integrity check failed"}
--snip--
Clicking Suricata: Rule Mismatch goes to Hunt tab and 3 "SOC.server" Events are listed.
One of the event messages reads:
{"fields":{"deployedButNotEnabled":["2053382","2051702","2027002","2042942","2049978","2060340","2103390","2017683","2043545","2028599","2012236","2020259","2012190","2041973","2046564","2058927","2021629","2043234","2030496","2060005"],"deployedButNotEnabledCount":44331,"detectionEngine":"suricata","enabledButNotDeployed":[],"enabledButNotDeployedCount":0,"intCheckId":"2d404682-fac1-4d3d-a41c-1a0e05db2e36"},"level":"warn","timestamp":"2025-08-21T15:04:10.499652366Z","message":"integrity check failed"}
so-elasticsearch-query _cluster/health?pretty
{
"cluster_name" : "securityonion",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 2,
"number_of_data_nodes" : 2,
"active_primary_shards" : 95,
"active_shards" : 167,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"unassigned_primary_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
Thanks in advance for any assistance.
Guidelines
Beta Was this translation helpful? Give feedback.
All reactions