Merge pull request #12001 from Security-Onion-Solutions/2.4/update-cl…

…ear-scripts FIX: Update clear scripts #11991
Security-Onion-Solutions · Dec 13, 2023 · b17e400 · b17e400
2 parents 196d598 + 2c4d0a0
commit b17e400
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 7 deletions.
diff --git a/salt/common/tools/sbin/so-nsm-clear b/salt/common/tools/sbin/so-nsm-clear
@@ -41,8 +41,13 @@ done
 if [ $SKIP -ne 1 ]; then
         # Inform user we are about to delete all data
         echo
-        echo "This script will delete all NIDS data (PCAP, Suricata, Zeek)" 
-        echo "If you would like to proceed, please type "AGREE" and hit ENTER."
+        echo "This script will delete all NSM data from /nsm."
+        echo
+        echo "This includes Suricata data, Zeek data, and full packet capture (PCAP)."
+        echo
+        echo "This will NOT delete any Suricata or Zeek logs that have already been ingested into Elasticsearch."
+        echo
+        echo "If you would like to proceed, then type AGREE and press ENTER."
         echo
         # Read user input
         read INPUT
@@ -54,8 +59,8 @@ delete_pcap() {
   [ -d $PCAP_DATA ] && so-pcap-stop && rm -rf $PCAP_DATA/* && so-pcap-start
 }
 delete_suricata() {
-  SURI_LOG="/opt/so/log/suricata/eve.json"
-  [ -f $SURI_LOG ] && so-suricata-stop && rm -f $SURI_LOG && so-suricata-start
+  SURI_LOG="/nsm/suricata/"
+  [ -d $SURI_LOG ] && so-suricata-stop && rm -rf $SURI_LOG/* && so-suricata-start
 }
 delete_zeek() {
   ZEEK_LOG="/nsm/zeek/logs/"

diff --git a/salt/elasticsearch/tools/sbin/so-elastic-clear b/salt/elasticsearch/tools/sbin/so-elastic-clear
@@ -67,7 +67,7 @@ if [ $SKIP -ne 1 ]; then
         echo
         echo "This script will delete all data (documents, indices, etc.) in the Elasticsearch database."
         echo
-        echo "If you would like to proceed, please type "AGREE" and hit ENTER."
+        echo "If you would like to proceed, then type AGREE and press ENTER."
         echo
         # Read user input
         read INPUT

diff --git a/salt/manager/tools/sbin_jinja/so-elastic-fleet-reset b/salt/manager/tools/sbin_jinja/so-elastic-fleet-reset
@@ -18,7 +18,7 @@ echo "This includes data previously ingested with Fleet such as Zeek and Suricat
 echo "Deployed Elastic Agents will no longer be enrolled and will need to be reinstalled."
 echo "This script should only be used as a last resort to reinstall Elastic Fleet." 
 echo
-echo "If you would like to proceed, type AGREE and hit ENTER."
+echo "If you would like to proceed, then type AGREE and press ENTER."
 echo
 # Read user input
 read INPUT
@@ -93,4 +93,4 @@ so-elastic-fleet-setup
 status "Re-installing Elastic Agent on all Grid Nodes..."
 salt \* state.apply elasticfleet.install_agent_grid queue=True
 
-status "Elastic Fleet Reset complete...."
+status "Elastic Fleet Reset complete...."