Strelka failed to sync on Security Onion 3.1.0.

On the manager node:

sudo rm /opt/so/conf/soc/fingerprints/strelkaengine.state
sudo so-soc-restart

SOC (webui on the manager node) → Detections → Gear button (on the top right) → Strelka → Full update → Close.

See also https://github.com/Security-Onion-Solutions/securityonion/discussions/15938.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes:

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>