[Solved]Alerts with no data

[xaqpuyrthnbg]

I have noticed that I will sometimes get alerts with and when I drilldown or filter it says "No data". Have I done something to cause this or is it a bug?

Thanks,

-D

[netsecninja]

I've seen the same behavior on 2.3.2.

[xaqpuyrthnbg]

Thanks for confirming my sanity.

[TOoSmOotH]

Can someone post a screenshot or an example?

[xaqpuyrthnbg]

It is intermittent behavior not affecting every alert. Here is a current example of the behavior:

[greatapoc]

I think it's an issue with the time picker, I get the same problem sometimes. I raised a similar issue earlier #1597

Maybe try making the time window wider and see if you get data.

[xaqpuyrthnbg]

Just tried 48 and 72 hours with the same result. Also, they were supposedly "new" alerts.

[dougburks]

Please try the following:

• click the alert
• on the Quick Action Bar, click the crosshairs icon to pivot to Hunt

Does the alert display there in Hunt?

If you drill into it, does anything look strange (particularly the timestamp fields)?

[xaqpuyrthnbg]

There are alerts in Hunt, however, they are all from yesterday and these alerts should have been from an action I just took this morning. See attached screenshot:

[dougburks]

Can you confirm that the timezone on your Security Onion box is set to UTC?

What is the timezone of your local browser?

[xaqpuyrthnbg]

Running date provides this output: Wed Nov 4 14:28:43 UTC 2020; browser is running Time Zone: America/New_York

[dougburks]

Please try the comment here:
#1824 (comment)

[xaqpuyrthnbg]

Yes, that does work in Hunt. However, in the Alerts screen when a new alert comes through and you use the drilldown button, sometimes there is no alert data for the past 24 hours. If I look at it in Hunt, I can see that there are alerts from the last hour.

So, I believe the data to be there, but for some reason it is not always showing up in alerts for easy review.

[xaqpuyrthnbg]

Good morning,

2.3.10 seems to have resolved this issues. I imagine the TZ DST issue is what was causing this.