OTX integration

[mbaki]

Hi all,

By mistake I ran https://raw.githubusercontent.com/weslambert/securityonion-otx/master/securityonion-otx on my sensor (distributed architecture) and now so-status shows zeek as "missing" how can I revert back.
Do I need to install it on my manager?

Thanks
Monah

[weslambert]

Hi @mbaki ,

You should run the script on the manager. I'm not sure if the script would affect anything on the sensor, since it is looking for the directory structure that exists on the manager, however, you can troubleshoot by reviewing /nsm/zeek/logs/current/reporter.log or docker logs so-zeek (but from your report, it sounds like a container may not be built yet). You may also try so-zeek-start to attempt to start it back up.