Cases Disappearing

[informalsecurity]

I have a new instance up and running for about 4 days now; twice in the past 4 days, all the Cases I have created have disappeared, as well as any alerts that I have escalated to be a part of those cases.

The first time it happened, I probably only had about 6 cases open. This time I had about 15. When I go to alerts to search for alerts that have been escalated - I am not getting anything back. Is there some kind of auto-pruning feature that is deleting cases? Is there somewhere I can look (specific database/table) to see if the data still exists - or is it lost forever.

[dougburks]

What is the output of the following?

sudo so-elasticsearch-indices-list |grep case

sudo grep -ri log_size_limit /opt/so/saltstack/local/pillar/

df -h

[informalsecurity]

[dougburks]

What is the output of the following?

zgrep "so-case" /opt/so/log/curator/*

I suspect that Curator is not excluding the case indices properly. If that's the case, we'll start working on a proper fix. In the meantime, a temporary option might be to increase log_size_limit in somanager_managersearch.sls to be a higher percentage of /nsm (depending on what other data you have there). Note that 126GB for /nsm is barely above the minimum requirements so you might want to increase that if possible:
https://docs.securityonion.net/en/2.3/partitioning.html

[informalsecurity]

[informalsecurity]

So if the index is being deleted - does that mean all the cases are completely gone? Also - would the original escalated alerts still be available somewhere?

[dougburks]

I've created issue #7270 to fix the Curator configuration.

It looks like Curator has deleted the cases. It's possible that some of the escalated alerts might still be there if you go to Alerts, click Options, and then click Escalated. However, it does look like Curator is having to delete fairly recent data to stay at your current log_size_limit value. Therefore, you'll most likely want to increase the size of your /nsm partition if at all possible.

[informalsecurity]

Working on it now; I appreciate the help and all the great things you guys do!

[dougburks]

We've merged a fix that will be included in the upcoming 2.3.110 release:
https://github.com/Security-Onion-Solutions/securityonion/pull/7273/files

[dougburks]

We've released an official hotfix for this:
https://blog.securityonion.net/2022/03/security-onion-23100-20220301-hotfix.html