FIR -Reporting Setup

[xSunShine]

Hello,

i managed to install FIR and i entered example domain during setup but since i do distrbuted in local network.Can someone point me what to do here.I usually access SO Web UI throw local ip,how could i access FIR and what should i setup throw setup?
i also tryed to edit /etc/hosts file but didn't help.

i have found it here https://docs.securityonion.net/en/2.3/fir.html

Thank you

[InfosecGoon]

Can you post the contents of this file?

/etc/apache2/sites-available/fir.conf

[xSunShine]

i have installed So in distrbuted mode and i have installed FIR on manager node, now i gace access to whole ip block to access SO manager web ui, do i have to find conf file u mentioned in SO or in docker container? when i get home i will check if i have that conf file. meanwhile can u tell me do i have to look for it in docker container which runs, for example i installed FIR on my workstation which is debian, i did all the same from the instruction page and i can access FIR but only if i type in localhost:8001 or just localhost, so i guess i need to allow who can access fir from the apache2 conf file?

[xSunShine]

i didnt find conf file u mentiomed in SO manager node where i installed FIR, maybe i need to access docker container and change it there?

[xSunShine]

here when i run command for installation i get this

`@soc-manager-prod securityonion-fir]$ sudo bash install_fir

=========================================================================
Cloning repo...

fatal: destination path 'securityonion-fir' already exists and is not an empty directory.

=========================================================================
Copying web config...

‘securityonion-fir/fir.conf’ -> ‘/etc/apache2/sites-available/fir.conf’
cp: cannot create regular file ‘/etc/apache2/sites-available/fir.conf’: No such file or directory

cp: cannot stat ‘/etc/apache2/sites-available/securityonion.conf’: No such file or directory
install_fir: line 20: a2ensite: command not found
Please specify a domain to use to access FIR (Example: fir.example.com) and press [ENTER]:
`

but when i run this same image docker on my local linux machine i can connect to web UI with http://localhost.

[InfosecGoon]

It looks like this is dependent on Apache, which is not installed by default in current versions of Security Onion - I don't think it is going to work without significant refactoring. The install script looks to be six years old, so it's making assumptions about SO that are no longer relevant.

If you're looking for a case management tool integrated with Security Onion, I'd suggest using Cases instead.

Cases Overview: https://www.youtube.com/watch?v=y_kr_hrtqVc

[xSunShine]

Well i was looking for some kinda reporting tool,but thanks any way for the help.i even tryed to install httpd on SO but nothing work.
Anyway thx for the help