Closed shaw2020 closed 5 months ago
Good morning, recently I installed the "HIVE" honeypot on my server with Debian 11.8. However, when I access the Kibana dashboard under the Suricata dashboard to view attack actions, I receive the following message in several fields:
suricata event bar: The field "tls.ja3.hash.keyword" associated with this object no longer exists in the data view. Please use another field.
suricata events: The field "tls.ja3.hash.keyword" associated with this object no longer exists in the data view. Please use another field.
All fields display a message like this. I need to know what I can do to resolve this issue.
Are there any Suricata logs, i.e. eve.json, in the /data folder? If not the Suricata dashboard is empty as there are no logs.
So the dashboard is only like this because no log has arrived yet?
Before you post your issue make sure it has not been answered yet and provide
basic support information
if you come to the conclusion it is a new issue.β οΈ Basic support information (commands are expected to run as
root
)lsb_release -a
anduname -a
?/install.log
/install.err
.glances
andhtop
.df -h
)?dps.sh
)?systemctl status tpot
)?systemctl stop tpot
and runnetstat -tulpen
DOWN
you can rundocker logs <container-name>
for the latest log entries