Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

filtering in Arkime sessions view returned zero rows for some reason #212

Closed
mmguero opened this issue Jun 14, 2023 · 2 comments
Closed

filtering in Arkime sessions view returned zero rows for some reason #212

mmguero opened this issue Jun 14, 2023 · 2 comments
Assignees
@mmguero
Labels
arkime Relating to Malcolm's use of Arkime bug Something isn't working external Depends on a bug or feature external to this project
Milestone
v23.09.0

Comments

@mmguero
Copy link
Collaborator

mmguero commented Jun 14, 2023

Here's what somebody using malcolm showed us:

  1. In arkime, go to sessions view
  2. Filter on smtp traffic
  3. Click on the value of a from or to field in the INFO column and && it into your filter
  4. No results are displayed

However, it worked when we filtered directly on the zeek column.
@mmguero mmguero added bug Something isn't working external Depends on a bug or feature external to this project arkime Relating to Malcolm's use of Arkime labels Jun 14, 2023
@mmguero mmguero added this to Malcolm Jun 14, 2023
@mmguero mmguero moved this to Todo (develop) in Malcolm Jun 14, 2023
@mmguero mmguero moved this from Todo (develop) to Triage in Malcolm Jun 14, 2023
@mmguero mmguero added this to the v23.08.0 milestone Jul 20, 2023
@mmguero mmguero moved this from Triage to Todo (develop) in Malcolm Jul 20, 2023
@mmguero mmguero moved this from Todo (develop) to Todo (spike) in Malcolm Jul 20, 2023
@mmguero mmguero modified the milestones: v23.08.0, v23.09.0 Aug 16, 2023
@mmguero mmguero self-assigned this Sep 11, 2023
@mmguero mmguero moved this from Todo (investigate) to In Progress in Malcolm Sep 11, 2023
mmguero added a commit to mmguero-dev/Malcolm that referenced this issue Sep 11, 2023
@mmguero
idaholab#212: since Malcolm is essentially overriding Arkime's index …
aef05ca 
…template, we need to make sure everything that should be in there is. So this commit is a copy/paste of the template from Arkime's db.pl into dashboards/templates/composable/component/arkime.json
@mmguero mmguero moved this from In Progress to Testing in Malcolm Sep 11, 2023
@mmguero
Copy link
Collaborator Author

mmguero commented Sep 11, 2023 •
edited
Loading

testing a fix now. The only concern I have at this point is this comment:

Modfified version of https://raw.githubusercontent.com/elastic/ecs/1.10/generated/elasticsearch/7/template.json

  1. change index_patterns
  2. Delete cloud,dns,http,tls,user,data_stream
  3. Add source.as.full, destination.as.full, source.mac-cnt, destination.mac-cnt, network.vlan.id-cnt

The issue being step 2. There is going to be some conflict between the ECS composable templates and Arkime's so I need to see how that manifests.

@mmguero
Copy link
Collaborator Author

mmguero commented Sep 14, 2023

I am not seeing any ill effects. Closing.

@mmguero mmguero moved this from Testing to Done in Malcolm Sep 14, 2023
@mmguero mmguero closed this as completed Sep 14, 2023
This was referenced Sep 15, 2023
Merged
Merged
@mmguero mmguero moved this from Done to Released in Malcolm Sep 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mmguero mmguero

Labels
arkime Relating to Malcolm's use of Arkime bug Something isn't working external Depends on a bug or feature external to this project
Projects
Malcolm
Status: Released
Milestone
v23.09.0
Development

No branches or pull requests
1 participant
@mmguero