Error running salt <sensorname>state.highstate

[mbaki]

Hi all,

After modifying my sensor.sls file by adding:
suricata:
config:
vars:
address-groups:
EXTERNAL_NET: "!$HOME_NET"

I then executed salt state.highstate. I got the following error message:

      ID: zeekpolicysync
Function: file.recurse
    Name: /opt/so/conf/zeek/policy
  Result: False
 Comment: #### /opt/so/conf/zeek/policy/custom/zeek-otx/.otx/4/a/6138debb9bd98b0f5c3983a4.json ####
          Unable to manage file: Jinja syntax error: Encountered unknown tag 's'.; line 1074

          ---
          [...]
              {
                "id": 3223183207,
                "indicator": "fda28a2031795e3ed0d455cd44a7c53fa70571f2",
                "type": "YARA",
                "created": "2021-09-08T16:03:08",
                "content": "rule apt_TR_EGoManiac_HT\n{\n\n\tmeta:\n\t\tdesc = \"HackingTeam samples related to TNP Ops\"\n\t\tauthor = \"JAG-S @ SentinelLabs\"\n\t\tlast_modified = \"09.02.2021\"\n\t\tversion = \"2.0\"\n\t\tTLP = \"White\"\n\t\treference = \"https://wikileaks.org/hackingteam/emails/emailid/506779\"\n\n\tstrings:\n\t\t$watermark1 = \"ZjvOuN3m\" ascii wide //pre 9.2\n\t\t$watermark2 = \"IdQcUI52\" ascii wide //post 9.2\n\n\t\t$ip1 = \"146.185.30.109\" ascii wide\n\t\t$ip2 = \"46.183.220.222\" ascii wide\n\t\t$ip3 = \"46.251.239.67\" ascii wide\n\t\t$ip4 = \"199.175.51.16\" ascii wide\n\t\t$ip5 = \"46.166.167.215\" ascii wide\n\t\t$path = \"/dispatch.asp\" ascii wide\n\t\t$htTell1 = \"Engine started\" ascii wide fullword\n\t\t$htTell2 = \"Running in background\" ascii wide fullword\n\t\t$htTell3 = \"Stale thread\" ascii wide fullword\n\t\t$htTell4 = \"The current thread is probably stale!\" ascii wide fullword\n\t\t$htTell5 = \"Locking doors\" ascii wide fullword\n\t\t$htTell6 = \"Rotors engaged\" ascii wide fullword\n\t\t$htTell7 = \"I'm going to start it\" ascii wide fullword\n\t\t$htTell8 = \"I'm going to start the program\" ascii wide\n\t\t$htTell9 = \"I'm going to start the program automatically, is it ok?\" ascii wide\n\t\t$htTell10 = \"Starting upgrade!\" ascii wide\n\t\t$drops1 = \"%s\\\\%S*tmp\" ascii wide fullword\n\t\t$drops2 = \"%s\\\\%s%x%x.tmp\" ascii wide fullword\n\t\t$drops3 = \"%s\\\\%d.bat\" ascii wide fullword\n\t\t$drops4 = \"%s\\\\%S.exe\" ascii wide fullword\n\t\t$drops5 = \"%s\\\\%s.tmp\" ascii wide fullword\n\t\t$gather1 = \"CPU: %d x %s\" ascii wide fullword\n\t\t$gather2 = \"RAM: %dMB free / %dMB total (%u%% used)\" ascii wide fullword\n\t\t$gather3 = \"Hard Disk: %dMB free / %dMB total\" ascii wide fullword\n\t\t$gather4 = \"Windows Version: %s%s%s%s%s\" ascii wide fullword\n\t\t$gather5 = \"Registered to: %s%s%s%s {%s}\" ascii wide fullword\n\t\t$gather6 = \"Locale: %s_%s (UTC %.2d:%.2d)\" ascii wide fullword\n\t\t$gather7 = \"User Info: %s%s%s%s%s\" ascii wide fullword\n\t\t$gather8 = \"Application List (x86):\" ascii wide fullword\n\t\t$gather9 = \"ApplicationList (x64):\" ascii wide fullword\n\t\t$gather10 = \"SID: %s\" ascii wide fullword\n\n\tcondition:\n\t\tuint16(0) == 0x5a4d and any of ($watermark*) and (any of ($ip*) or $path or any of ($htTell*) or all of ($drops*) or 5 of ($gather*))\n}",    <======================
                "title": "apt_TR_EGoManiac_HT",
                "description": "",
                "expiration": null,
                "is_active": 1,
                "role": null
          [...]
          ---
 Started: 14:10:31.559920
Duration: 14656.305 ms
 Changes:

---

      ID: so-zeek
Function: docker_container.running
  Result: False
 Comment: One or more requisite failed: zeek.zeekpolicysync
 Started: 14:10:46.445002
Duration: 0.008 ms
 Changes:

---

Which file/location should I look for?

Thanks
Monah

[weslambert]

It looks like for some reason, YARA rules and maybe other indicators are being written to a file (or temp file) within the /opt/so/salstack/local/salt/zeek/policy/custom/zeek-otx/ directory (then Salt is trying to replicate to the equivalent directory under /opt/so/conf. What other directories or files are listed under that directory structure?

[mbaki]

Hi Wes,

So in my somanager

[root@somanager zeek-otx]# ls /opt/so/saltstack/local/salt/
_beacons curator docker_clean elasticsearch fleet healthcheck kibana manager motd nodered pipeline redis salt soctopus suricata telegraf wazuh ca deprecated-launcher domainstats filebeat freqserver idstools learn minio mysql patch playbook registry sensoroni ssl systemd thehive yum
common docker elastalert firewall grafana influxdb logstash _modules nginx pcap reactor repo soc strelka tcpreplay utility zeek

[root@somanager zeek-otx]# ls /opt/so/saltstack/local/salt/zeek/policy/custom/zeek-otx/
bro-pkg.meta LICENSE load.zeek otx.dat README.md requirements.txt zeek_otx.conf

[root@somanager zeek-otx]# ls /opt/so/conf/
aptcacher-ng cortex docker-registry elasticsearch fleet idstools kibana log-rotate.conf mysql nginx sensoroni soctopus steno thehive
ca curator elastalert filebeat grafana influxdb kratos logstash navigator redis soc so-status telegraf wazuh

[dougburks]

Are you running the Zeek-OTX integration here?
https://docs.securityonion.net/en/2.3/alienvault-otx.html

I just tested that integration and was not able to duplicate this behavior. I don't have /opt/so/conf/zeek/policy/custom/zeek-otx/.otx/4/a/6138debb9bd98b0f5c3983a4.json and I don't have any file containing apt_TR_EGoManiac_HT in /opt/so/conf/zeek/policy/custom/zeek-otx/.otx/.

Have you tried updating the OTX data?

sudo python3 /usr/sbin/zeek_otx.py

[m0duspwnens]

@mbaki The file/opt/so/conf/zeek/policy/custom/zeek-otx/.otx/4/a/6138debb9bd98b0f5c3983a4.json is being rendered as a jinja template and the line with \"Registered to: %s%s%s%s {%s}\" more specifically the {%s} is causing issues. If you edit the file, and make the very first line read {% raw %} and the very last line {% endraw %} then it will cause the text between to not be rendered as jinja and you should have success running salt-call state.highstate.

[mbaki]

Running salt-call state.highstate

Summary for local

Succeeded: 593 (changed=23)
Failed: 0

Total states run: 593
Total run time: 53.698 s

where as salt "sensorname" state.highstate still generates the error.

I added the very first line read {% raw %} and the very last line {% endraw %}, but somehow it reverts it back to "{" and "}".
The intel.dat gets updated and in Kibana I do see alerts, just curious to the error message.
I too don't have apt_TR_EGoManiac_HT in ``/opt/so/conf/zeek/policy/custom/zeek-otx/.otx/`.

Will close this. Thank you.

Monah

[dougburks]

I too don't have apt_TR_EGoManiac_HT in ``/opt/so/conf/zeek/policy/custom/zeek-otx/.otx/`.

apt_TR_EGoManiac_HT came from your original post above so at one point you had it in your deployment. Have you checked both your manager and sensor to make sure it is gone from both?