Post 2.4.100 upgrade from 2.4.90, Dashboard menu : System Windows Security errors

[kvkamin]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

64

RAM

128G

Storage for /

455G

Storage for /nsm

7TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Dashboard menu item "System Windows Security" has two sub-menus, "User Logon Information" and "Logon Failed and Account Lockout " both display this error : "Field source.ip is of the wrong type" for several panels.

This menu item worked under 2.4.90 and previous.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[kvkamin]

Another broken Dashboard. "Security Onion - Alerts" - two tables have these errors.
Saved field "source.ip" of data view "logs-" is invalid for use with the "Terms" aggregation. Please select a new field.
Saved field "destination.ip" of data view "logs-" is invalid for use with the "Terms" aggregation. Please select a new field.

[kvkamin]

add the "Security Onion - RDP"
Saved field "source.ip" of data view "logs-" is invalid for use with the "Terms" aggregation. Please select a new field.
Saved field "destination.ip" of data view "logs-" is invalid for use with the "Terms" aggregation. Please select a new field.

[kvkamin]

sorry for the slow drip here, but Security Onion - SSH, same issue.

All my favorites!

[dougburks]

The team is looking into this.

[dougburks]

We've identified the root cause of this issue and are preparing a hotfix that should be released next week. In the meantime, you should be able to use SOC Dashboards instead of Kibana dashboards.

For folks that haven't updated yet, we recommend holding off until the hotfix is released to avoid any potential issues.

We've updated the blog post with a warning to this effect as well:
https://blog.securityonion.net/2024/08/security-onion-24100-now-available.html

[dougburks]

Security Onion 2.4.100 Hotfix 20240903 now available!
https://blog.securityonion.net/2024/09/security-onion-24100-hotfix-20240903.html

[kvkamin]

I applied hotfix and executed the two scripts as instructed. No change to any of the menus.

[kvkamin]

[kvkamin]

Any progress on a fix?

[weslambert]

We are working on a fix for the next release. For now, you could manually add the mapping for destination.ip.

[kvkamin]

thanks. I did manage to fix all the menus I cared about.

[TFWol]

I have the same issue (as well as mapping conflicts) after upgrading from 2.4.90 to 2.4.100-20240903. Standalone install in my case.

[dougburks]

@TFWol Please make sure that you've performed the steps in the blog:
https://blog.securityonion.net/2024/09/security-onion-24100-hotfix-20240903.html

If you continue to have issues after performing those steps, then please start a separate discussion and provide detailed information about your system, any agents you've deployed or extra data you're ingesting, and what exactly you're seeing.

[TFWol]

I should mention that I had performed the steps while reading through this Issue. It's the same as what @kvkamin was seeing except I had upgraded from .90 directly to the .100 hotfixed version.

I'll submit a new issue if the problem persists past the fix you mentioned that's being worked on, but in the meantime what was the workaround that ended up with this comment?

[TFWol]

It looks like there's traction