Request Failed with status code 400: Cases

[thegreekman]

Hello, I had a previous discussion open for this issue, but it was never resolved. #7587

I would really like to get this working on my deployment of security onion. Its currently on version 2.3.110 Below is the error that shows up in /opt/so/log/sensoroni/sensoroni-server.log when trying to escalate an alert.

Please let me know if anymore information is needed
Security Onion version: 2.3.110
On Prem and internet access deployment
Installed from an SO
1 master node
Are you experiencing issues monitoring network traffic? If so, are you sniffing from a tap or span port and what is the traffic volume? No
Does so-status show all services running? Yes
Do you get any failures when you run sudo salt-call state.highstate? No
Does the SOC Grid page show any failures? No

When I input the following query: so-elasticsearch-query "so-case/_mappings" | jq, I noticed the mapping is incorrect

I tried reindexing so-case* using the experimental script but it didnt do anything. Any help is much appreciated

[dougburks]

Since you're still on version 2.3.110 which is several months old at this point, I'd recommend starting with upgrading to the latest 2.3.181 version:
https://blog.securityonion.net/2022/10/security-onion-23181-now-available.html

[thegreekman]

Unfortunately upgrading is not a possibility for the environment at this time, is there any other potential solution to this? This issue has been on this system since the release of cases, prior to upgrading to 2.3.110

[weslambert]

What is the output of the following?

sudo so-elasticsearch-query _index_template/so-case | jq
sudo so-elasticsearch-query _component_template/case-mappings | jq
sudo so-elasticsearch-query _component_template/case-settings | jq

[thegreekman]

so-elasticsearch-query _index_template/so-case | jq

so-elasticsearch-query _component_template/case-mappings | jq
{
"index_templates": [
{
"name": "so-case",
"index_template": {
"index_patterns": [
"so-case*"
],
"template": {
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1500"
}
},
"refresh_interval": "30s",
"number_of_shards": "1",
"number_of_replicas": "0"
}
},
"mappings": {
"_routing": {
"required": false
},
"numeric_detection": false,
"dynamic": true,
"_source": {
"excludes": [],
"includes": [],
"enabled": true
},
"dynamic_templates": [
{
"strings_as_keyword": {
"mapping": {
"ignore_above": 1024,
"type": "keyword"
},
"match_mapping_type": "string"
}
}
],
"date_detection": false
}
},
"composed_of": [
"case-mappings",
"case-settings"
],
"priority": 500
}
}
]
}
[root@MSSOC1 nsm]# so-elasticsearch-query _component_template/case-mappings | jq
{
"component_templates": [
{
"name": "case-mappings",
"component_template": {
"template": {
"settings": {
"index": {
"analysis": {
"filter": {
"path_hierarchy_pattern_filter": {
"type": "pattern_capture",
"preserve_original": "true",
"patterns": [
"((?:[^\\\\]\\))(.)",
"((?:[^/]/))(.)"
]
}
},
"char_filter": {
"whitespace_no_way": {
"pattern": "(\s)+",
"type": "pattern_replace",
"replacement": "$1"
}
},
"analyzer": {
"es_security_analyzer": {
"filter": [
"lowercase",
"trim"
],
"char_filter": [
"whitespace_no_way"
],
"type": "custom",
"tokenizer": "keyword"
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\"
}
}
}
}
},
"mappings": {
"properties": {
"so_audit_doc_id": {
"ignore_above": 1024,
"type": "keyword"
},
"so_related": {
"properties": {
"createTime": {
"type": "date"
},
"caseId": {
"ignore_above": 1024,
"type": "keyword"
},
"fields": {
"eager_global_ordinals": false,
"ignore_above": 1024,
"index": true,
"type": "flattened",
"index_options": "docs",
"split_queries_on_whitespace": false,
"doc_values": true
},
"userId": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"@timestamp": {
"type": "date"
},
"so_artifactstream": {
"properties": {
"createTime": {
"type": "date"
},
"userId": {
"ignore_above": 1024,
"type": "keyword"
},
"content": {
"type": "text"
}
}
},
"so_comment": {
"properties": {
"createTime": {
"type": "date"
},
"caseId": {
"ignore_above": 1024,
"type": "keyword"
},
"description": {
"type": "text"
},
"userId": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"so_kind": {
"ignore_above": 1024,
"type": "keyword"
},
"so_operation": {
"ignore_above": 1024,
"type": "keyword"
},
"so_case": {
"properties": {
"severity": {
"ignore_above": 1024,
"type": "keyword"
},
"template": {
"ignore_above": 1024,
"type": "keyword"
},
"completeTime": {
"type": "date"
},
"description": {
"type": "text"
},
"priority": {
"type": "long"
},
"title": {
"type": "text"
},
"assigneeId": {
"ignore_above": 1024,
"type": "keyword"
},
"userId": {
"ignore_above": 1024,
"type": "keyword"
},
"tags": {
"ignore_above": 1024,
"type": "keyword"
},
"createTime": {
"type": "date"
},
"tlp": {
"ignore_above": 1024,
"type": "keyword"
},
"startTime": {
"type": "date"
},
"category": {
"ignore_above": 1024,
"type": "keyword"
},
"pap": {
"ignore_above": 1024,
"type": "keyword"
},
"status": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"so_artifact": {
"properties": {
"artifactType": {
"ignore_above": 1024,
"type": "keyword"
},
"groupType": {
"ignore_above": 1024,
"type": "keyword"
},
"sha256": {
"ignore_above": 1024,
"type": "keyword"
},
"streamId": {
"ignore_above": 1024,
"type": "keyword"
},
"groupId": {
"ignore_above": 1024,
"type": "keyword"
},
"streamLength": {
"type": "long"
},
"description": {
"type": "text"
},
"mimeType": {
"ignore_above": 1024,
"type": "keyword"
},
"userId": {
"ignore_above": 1024,
"type": "keyword"
},
"tags": {
"ignore_above": 1024,
"type": "keyword"
},
"sha1": {
"ignore_above": 1024,
"type": "keyword"
},
"createTime": {
"type": "date"
},
"caseId": {
"ignore_above": 1024,
"type": "keyword"
},
"tlp": {
"ignore_above": 1024,
"type": "keyword"
},
"ioc": {
"type": "boolean"
},
"value": {
"type": "text",
"fields": {
"keyword": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"md5": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
},
"_meta": {
"ecs_version": "1.12.2"
}
}
}
]
}

so-elasticsearch-query _component_template/case-settings | jq
{
"component_templates": [
{
"name": "case-settings",
"component_template": {
"template": {
"settings": {
"index": {
"routing": {
"allocation": {
"require": {
"box_type": "hot"
}
}
},
"mapping": {
"total_fields": {
"limit": "3000"
}
},
"refresh_interval": "30s",
"analysis": {
"filter": {
"path_hierarchy_pattern_filter": {
"type": "pattern_capture",
"preserve_original": "true",
"patterns": [
"((?:[^\\\\]\\))(.)",
"((?:[^/]/))(.)"
]
}
},
"char_filter": {
"whitespace_no_way": {
"pattern": "(\s)+",
"type": "pattern_replace",
"replacement": "$1"
}
},
"analyzer": {
"es_security_analyzer": {
"filter": [
"lowercase",
"trim"
],
"char_filter": [
"whitespace_no_way"
],
"type": "custom",
"tokenizer": "keyword"
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\"
}
}
},
"number_of_shards": "1",
"number_of_replicas": "0"
}
}
},
"version": 1,
"_meta": {
"description": "default settings for common Security Onion Cases indices"
}
}
}
]
}

[weslambert]

What does the mapping for so-casehistory look like?

[thegreekman]

so-casehistory mapping:
{
"mappings": {
"_doc": {
"dynamic": "false",
"dynamic_templates": [
{
"ip_address": {
"path_match": ".ip",
"match_mapping_type": "string",
"mapping": {
"fields": {
"keyword": {
"ignore_above": 45,
"type": "keyword"
}
},
"type": "ip"
}
}
},
{
"port": {
"path_match": ".port",
"path_unmatch": "*.data.port",
"mapping": {
"fields": {
"keyword": {
"ignore_above": 6,
"type": "keyword"
}
},
"type": "integer"
}
}
},
{
"strings": {
"match_mapping_type": "string",
"mapping": {
"fields": {
"security": {
"analyzer": "es_security_analyzer",
"type": "text"
},
"keyword": {
"ignore_above": 32765,
"type": "keyword"
}
},
"type": "text"
}
}
}
],
"date_detection": false,
"properties": {
"@timestamp": {
"type": "date"
},
"@Version": {
"type": "keyword"
},
"agent": {
"type": "object",
"dynamic": "true"
},
"alert": {
"type": "object",
"dynamic": "true"
},
"as": {
"type": "object",
"dynamic": "true"
},
"aws": {
"type": "object",
"dynamic": "true"
},
"azure": {
"type": "object",
"dynamic": "true"
},
"barracuda": {
"type": "object",
"dynamic": "true"
},
"bluecoat": {
"type": "object",
"dynamic": "true"
},
"cef": {
"type": "object",
"dynamic": "true"
},
"checkpoint": {
"type": "object",
"dynamic": "true"
},
"cisco": {
"type": "object",
"dynamic": "true"
},
"client": {
"type": "object",
"dynamic": "true"
},
"cloud": {
"type": "object",
"dynamic": "true"
},
"code_signature": {
"type": "object",
"dynamic": "true"
},
"connection": {
"type": "object",
"dynamic": "true"
},
"container": {
"type": "object",
"dynamic": "true"
},
"cyberark": {
"type": "object",
"dynamic": "true"
},
"cylance": {
"type": "object",
"dynamic": "true"
},
"data": {
"type": "object",
"dynamic": "true"
},
"dce_rpc": {
"type": "object",
"dynamic": "true"
},
"destination": {
"type": "object",
"dynamic": "true"
},
"destination_geo": {
"dynamic": "true",
"properties": {
"ip": {
"type": "ip"
},
"latitude": {
"type": "half_float"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "half_float"
}
}
},
"dhcp": {
"type": "object",
"dynamic": "true"
},
"dll": {
"type": "object",
"dynamic": "true"
},
"dnp3": {
"type": "object",
"dynamic": "true"
},
"dns": {
"type": "object",
"dynamic": "true"
},
"ecs": {
"type": "object",
"dynamic": "true"
},
"elasticsearch": {
"type": "object",
"dynamic": "true"
},
"error": {
"type": "object",
"dynamic": "true"
},
"event": {
"type": "object",
"dynamic": "true"
},
"event_data": {
"type": "object",
"dynamic": "true"
},
"f5": {
"type": "object",
"dynamic": "true"
},
"file": {
"type": "object",
"dynamic": "true"
},
"flow": {
"type": "object",
"dynamic": "true"
},
"fortinet": {
"type": "object",
"dynamic": "true"
},
"ftp": {
"type": "object",
"dynamic": "true"
},
"gcp": {
"type": "object",
"dynamic": "true"
},
"geo": {
"type": "object",
"dynamic": "true"
},
"geoip": {
"dynamic": "true",
"properties": {
"ip": {
"type": "ip"
},
"latitude": {
"type": "half_float"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "half_float"
}
}
},
"google_workspace": {
"type": "object",
"dynamic": "true"
},
"group": {
"type": "object",
"dynamic": "true"
},
"hash": {
"type": "object",
"dynamic": "true"
},
"host": {
"type": "object",
"dynamic": "true"
},
"http": {
"type": "object",
"dynamic": "true"
},
"imperva": {
"type": "object",
"dynamic": "true"
},
"import": {
"type": "object",
"dynamic": "true"
},
"infoblox": {
"type": "object",
"dynamic": "true"
},
"ingest": {
"dynamic": "true",
"properties": {
"timestamp": {
"type": "date"
}
}
},
"intel": {
"dynamic": "true",
"properties": {
"indicator": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
}
}
},
"interface": {
"type": "object",
"dynamic": "true"
},
"ip": {
"type": "object",
"dynamic": "true"
},
"irc": {
"type": "object",
"dynamic": "true"
},
"juniper": {
"type": "object",
"dynamic": "true"
},
"kerberos": {
"type": "object",
"dynamic": "true"
},
"kibana": {
"type": "object",
"dynamic": "true"
},
"log": {
"type": "object",
"dynamic": "true"
},
"logscan": {
"type": "object",
"dynamic": "true"
},
"logstash": {
"type": "object",
"dynamic": "true"
},
"manager": {
"type": "object",
"dynamic": "true"
},
"message": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 32766
}
}
},
"microsoft": {
"type": "object",
"dynamic": "true"
},
"misp": {
"type": "object",
"dynamic": "true"
},
"modbus": {
"type": "object",
"dynamic": "true"
},
"mysql": {
"type": "object",
"dynamic": "true"
},
"netflow": {
"type": "object",
"dynamic": "true"
},
"netscout": {
"type": "object",
"dynamic": "true"
},
"network": {
"type": "object",
"dynamic": "true"
},
"notice": {
"type": "object",
"dynamic": "true"
},
"ntlm": {
"type": "object",
"dynamic": "true"
},
"o365": {
"type": "object",
"dynamic": "true"
},
"observer": {
"type": "object",
"dynamic": "true"
},
"okta": {
"type": "object",
"dynamic": "true"
},
"organization": {
"type": "object",
"dynamic": "true"
},
"os": {
"type": "object",
"dynamic": "true"
},
"osquery": {
"type": "object",
"dynamic": "true"
},
"package": {
"type": "object",
"dynamic": "true"
},
"pe": {
"type": "object",
"dynamic": "true"
},
"process": {
"type": "object",
"dynamic": "true"
},
"proofpoint": {
"type": "object",
"dynamic": "true"
},
"radius": {
"type": "object",
"dynamic": "true"
},
"radware": {
"type": "object",
"dynamic": "true"
},
"rdp": {
"type": "object",
"dynamic": "true"
},
"redis": {
"type": "object",
"dynamic": "true"
},
"registry": {
"type": "object",
"dynamic": "true"
},
"related": {
"type": "object",
"dynamic": "true"
},
"request": {
"type": "object",
"dynamic": "true"
},
"result": {
"type": "object",
"dynamic": "true"
},
"rfb": {
"type": "object",
"dynamic": "true"
},
"rule": {
"dynamic": "true",
"properties": {
"score": {
"type": "long"
},
"uuid": {
"type": "keyword"
}
}
},
"scan": {
"dynamic": "true",
"properties": {
"exiftool": {
"type": "text"
}
}
},
"server": {
"type": "object",
"dynamic": "true"
},
"service": {
"type": "object",
"dynamic": "true"
},
"sip": {
"type": "object",
"dynamic": "true"
},
"smb": {
"type": "object",
"dynamic": "true"
},
"smtp": {
"type": "object",
"dynamic": "true"
},
"snmp": {
"type": "object",
"dynamic": "true"
},
"snort": {
"type": "object",
"dynamic": "true"
},
"snyk": {
"type": "object",
"dynamic": "true"
},
"socks": {
"type": "object",
"dynamic": "true"
},
"software": {
"type": "object",
"dynamic": "true"
},
"sonicwall": {
"type": "object",
"dynamic": "true"
},
"sophos": {
"type": "object",
"dynamic": "true"
},
"source": {
"type": "object",
"dynamic": "true"
},
"source_geo": {
"dynamic": "true",
"properties": {
"ip": {
"type": "ip"
},
"latitude": {
"type": "half_float"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "half_float"
}
}
},
"squid": {
"type": "object",
"dynamic": "true"
},
"ssh": {
"type": "object",
"dynamic": "true"
},
"ssl": {
"type": "object",
"dynamic": "true"
},
"suricata": {
"type": "object",
"dynamic": "true"
},
"syslog": {
"type": "object",
"dynamic": "true"
},
"tags": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"threat": {
"type": "object",
"dynamic": "true"
},
"tls": {
"type": "object",
"dynamic": "true"
},
"tomcat": {
"type": "object",
"dynamic": "true"
},
"trace": {
"type": "object",
"dynamic": "true"
},
"tunnel": {
"type": "object",
"dynamic": "true"
},
"user": {
"type": "object",
"dynamic": "true"
},
"user_agent": {
"type": "object",
"dynamic": "true"
},
"version": {
"type": "object",
"dynamic": "true"
},
"vlan": {
"type": "object",
"dynamic": "true"
},
"vulnerability": {
"type": "object",
"dynamic": "true"
},
"wazuh": {
"type": "object",
"dynamic": "true"
},
"weird": {
"type": "object",
"dynamic": "true"
},
"winlog": {
"dynamic": "true",
"properties": {
"event_data": {
"type": "object"
},
"event_id": {
"type": "long"
},
"version": {
"type": "long"
}
}
},
"x509": {
"type": "object",
"dynamic": "true"
},
"zcaler": {
"type": "object",
"dynamic": "true"
},
"zeek": {
"type": "object",
"dynamic": "true"
}
}
}
}
}