Error doing a playbook update

[WPTechnician]

When I run so-playbook-ruleupdate, I get the following error:

-= Started: 2022-11-22 17:20:35.777335-=

-= Creating/Updating Plays based on the following categories: ['windows'] -=

-= Parsing current Plays in Playbook -=

offset: 100
Traceback (most recent call last):
File "/SOCtopus/playbook_bulk-update.py", line 162, in
play_meta = playbook.play_metadata(i['id'])
File "/SOCtopus/playbook.py", line 397, in play_metadata
sigma_dict = yaml.load(sigma_raw)
File "/usr/local/lib/python3.9/site-packages/ruamel/yaml/main.py", line 343, in load
return constructor.get_single_data()
File "/usr/local/lib/python3.9/site-packages/ruamel/yaml/constructor.py", line 111, in get_single_data
node = self.composer.get_single_node()
File "_ruamel_yaml.pyx", line 706, in _ruamel_yaml.CParser.get_single_node
File "_ruamel_yaml.pyx", line 724, in _ruamel_yaml.CParser._compose_document
File "_ruamel_yaml.pyx", line 775, in _ruamel_yaml.CParser._compose_node
File "_ruamel_yaml.pyx", line 889, in _ruamel_yaml.CParser._compose_mapping_node
File "_ruamel_yaml.pyx", line 775, in _ruamel_yaml.CParser._compose_node
File "_ruamel_yaml.pyx", line 889, in _ruamel_yaml.CParser._compose_mapping_node
File "_ruamel_yaml.pyx", line 775, in _ruamel_yaml.CParser._compose_node
File "_ruamel_yaml.pyx", line 889, in _ruamel_yaml.CParser._compose_mapping_node
File "_ruamel_yaml.pyx", line 773, in _ruamel_yaml.CParser._compose_node
File "_ruamel_yaml.pyx", line 852, in _ruamel_yaml.CParser._compose_sequence_node
File "_ruamel_yaml.pyx", line 904, in _ruamel_yaml.CParser._parse_next_event
ruamel.yaml.scanner.ScannerError: while scanning for the next token
found character that cannot start any token
in "", line 50, column 1

Is there a way to figure out which rule is causing the complaint? I looked through the playbook and docker logs and didn't see anything obvious. Thanks!

[defensivedepth]

What version of Security Onion are you running? Did you run the command on the Manager?

[WPTechnician]

We are running version 2.3.180. I run all the commands from the manager. Thanks!

[defensivedepth]

Any custom Plays or changes to any of the default ones?

[WPTechnician]

Yes, I had added some filters to the default ones before I had read the documentation (oops) and I am fairly certain that is causing me grief but the error it is throwing isn't pointing to any one play in particular that I can discern.

[defensivedepth]

Ya, it looks like it's choking on some type of yaml issue perhaps.

So a couple things to try:

• Sort the list of Plays by last Updated, and see if you can restore / delete the ones that you edited previously. You have to login as Admin to delete the Play, it will be re-created during the update process.

• You can also do a full reset by running so-playbook-reset, which will blow away everything related to playbook and reinstall it. Last resort obviously :)

[WPTechnician]

Thanks for that, I went with the nuclear play as I hadn't done too much with it yet anyway and want to start again. It is updating fine so it was definitely me messing with the default plays. Thanks for your help!