Suricata Threat Hunting Dashboard stopped reporting

[Tim Guy]

Hi

Its most likey that the best way to resolve this would be to reinstall selks BUT I am trying to find out why its stopped reporting.

I am sending data to selks from a Mikrotik router to eve.json. The eve.json is still taking on data BUT its not coming through the dashboard.

Is there anything obvious I can look at to see why its not working anymore.

Tim

[Peter Manev]

Hi,

It does not seem that you should need reinstallation , but let's check
a few things
The Hunting dashboard displays only the suricata alerts with their
corelated network protocol , flow, anomaly and file transaction logs.
It does not however display the rest of the NSM data.
If you open Kibana - for example the SN-DNS or the SN-FLOW dashboards
- would you see logs?

Thank you

> --
> Discord: Let's talk about SELKS on
> https://discord.com/channels/911231224448712714/911238451842666546
> Wiki: https://github.com/StamusNetworks/SELKS/wiki
> GitHub: https://github.com/StamusNetworks/SELKS
> Blog: https://www.stamus-networks.com/blog
> Twitter: @StamusN
> ---
> You received this message because you are subscribed to the Google Groups "SELKS" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to selks+un...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/selks/CAD61_NU5bdx3T4nACag2EUMh%3DThstLU-qnTm20E3c-i8a8mckg%40mail.gmail.com.



--
Regards,
Peter Manev

[Tim Guy]

Ahhhhh, yes there is recent data in those Kibana dashboards

Tim

[timg...@gmail.com]

Hi Peter

 

Well I still cant find out to reset it. Everything’s coming into Kibana but nothing is coming up on the hunt pages which as a knock on means my Mikrotik isn’t get the block alerts.

 

Any suggestions?

 

Tim

[Peter Manev]

Hi , 

This means that for some reason there are no alerts generated but the rest of the network logs are there. 

I would suggest starting to look at the suricata.log to see for any errors ?

Thank you 

-- 

Regards,

Peter Manev 

On 24 Jun 2023, at 12:40, timg...@gmail.com wrote:



[Tim Guy]

I removed the default rule completely, added it back and then just added one source in and it start up again. No idea what went wrong but happy with that

[Peter Manev]

Hi, 

Probably the suricata.log would be able to show some info of what might have been the reason.

Thank you for the feedback !

Glad it is all back to normal.

-- 

Regards,

Peter Manev 

On 6 Jul 2023, at 14:34, Tim Guy <timg...@gmail.com> wrote: