tpotce data

[kevinelwell]

When I reboot tpotce, the only data in the dashboards that seems to persist is the Suricata data. Is this by design? If so, is there a way to make all the data persist?

[t3chn0m4g3]

No, but you did set a timeframe other than 15 minutes in the upper right corner?

[kevinelwell]

Yes, I went back 30 days. I see all of the Suricata data, but that is about it.

[t3chn0m4g3]

All detected events are persisted for 90 days.
If you do not even see any other data than Suricata than it is most likely your machine was either not exposed correctly or just did not have any events. You can run the /opt/tpot/bin/hptest.sh to verify your installation is working. However, afterwards you should reboot the machine.

[kevinelwell]

I ran /opt/tpot/bin/hptest.sh and it installed some missing components like nmap, netcat, and others. I am rebooting now. Thank you.

[t3chn0m4g3]

It only installs the components needed to run the test. If all is successful you will see some events in Kibana.

[kevinelwell]

It was successful. After the reboot, i see data. Thank you for your assistance.