SO2.4.10 "No Sysmon Logs"

[ColeVan]

I am currently running Security Onion 2.4.10 in standalone mode. Upon installing the elastic agent on a couple of hosts, I cannot see any Sysmon logs. Any suggestion? Everything is in working order from what I can tell. Sysmon is running on the endpoints and the settings are enabled in the initial endpoints policy to capture Sysmon events. I even added a custom event log integration package to capture Security logs which works perfectly. Perhaps something wrong with the initial endpoints package??

[weslambert]

A couple of questions:

• If you navigate to the Windows integration and go to Settings, what version does it show?
• If you navigate to Kibana -> Stack Management -> Index Management -> Component Templates -> search for sysmon, and view the package template, then navigate to settings what does it show for the default pipeline value?

[ColeVan]

Thanks for getting back to me. Here are the screenshots to your questions.
Windows integration

Sysmon templates. There seem to be two. One of the component templates has nothing in it.

[weslambert]

Try clicking Reinstall Windows from the Windows integration. After that, let me know if the default pipeline value in the @package template changes , matches the version of the Windows integration, and if you receive Sysmon logs.

[ColeVan]

Seems to have updated the template to 1.24. I'm seeing sysmon logs now.

[0nnyx]

Faced the same issue on a fresh install of 2.4.10 standalone. Got resolved after doing Reinstall Windows from the Windows integration.
Pretty sure other people are also facing this issue but didn't notice it yet.

[TOoSmOotH]

We are working on a hotfix to address this.