Uncategorized events - -Do they exist?

[xfaith]

So moving from 16.04 to 2.3 and used to seeing Uncatorgized events in 16.04 and Suricata, and wanted to see if that is still in 2.3.
Second I know that we were able to get Top 20 alerts, and uncategorized events via mysql (and via sostat).

Does any of that exist outside of the SOC (Looking at options for remote sites to send data highlights back that are easy). I like sostat cause it was a quick command they can run and email out.

Thanks

[dougburks]

So moving from 16.04 to 2.3 and used to seeing Uncatorgized events in 16.04 and Suricata, and wanted to see if that is still in 2.3.

In Security Onion 2.3, the equivalent of Uncategorized Events is shown on the Alerts page. The default view shows events that have not been acknowledged or escalated:
https://docs.securityonion.net/en/2.3/alerts.html

Second I know that we were able to get Top 20 alerts, and uncategorized events via mysql (and via sostat).

Alerts are now stored in Elasticsearch rather than mysql, so you might be able to put together a command line query using so-elasticsearch-query:
https://docs.securityonion.net/en/2.3/so-elasticsearch-query.html

[xfaith]

Doug, Does this go with the same issue if you left the Alert increase to the 100k, 200k ?

[dougburks]

I'm not sure I understand what you're asking.

[xfaith]

With mysql in 16.04 if the uncategorized reached high numbers it kind of slowed/.killed the system (at least that is what we noticed). 100k, 200k, ect. - Suricata gone wild.

[dougburks]

That was mostly an issue with MySQL merge tables and should be less of a concern now that we're using Elasticsearch. However, it's still good practice to acknowledge alerts on a regular basis to avoid reaching those numbers.