3.1.0 kibana permission are not corrolated to SO

[udi-mosh]

Version

3.1.0

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

24

RAM

128

Storage for /

400GB

Storage for /nsm

5TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,
after upgrading to 3.1.0, the permission in kibana are not aligned with so. did the sync but no change.
for ex., i am a superuser and in kibana i do not have access to alerts or rules.
what do i need to do ?
thanks

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[udi-mosh]

the reason for opening this discussion is that i do not see alerts under Kibana->Security as i used to.
i have tried creating a new kibana user with all the admin and system builtin roles and still no change.
i have to solve this quickly or i will have to revert to version 3.0.0
need help A.S.A.P please

[udi-mosh]

when i go to kibana->stack management->alerts i get permission denied

[udi-mosh]

anyone ???
is it a bug ? is it a feature ?

[cm-ops]

I never said it was disabled. I said using Kibana Detection Rules (SIEM) are not supported. I can get there and see everything on my 3.1 grid.

Have you looked in your browser tools to see the permission error?

[udi-mosh]

This is very strange. All my 3.1 are lacking access and i have tried
installing from scratch. I have installed 3.0 from scratch and got access.
I tried it with standalone and distributed. Since you say it works on your
grid, the only difference i can think of is that i jnstslled it as
air-gapped. Do you have the ability to run the setup like i did and see if
you if you get the same error ?
I will try to use broswer tools as suggested

[udi-mosh]

i have installed a new instance and this time i chose standard instead of air-gapped and got the same result.
if it is not a license issue, then clearly there is a general problem. i do not see any other possibility when i am doing nothing different than just install from iso

[cm-ops]

Thank you for that, I was able to see this on a test VM.

Would you check Kibana > Stack Management > Spaces > Default > Open Management and make sure Stack Monitoring is checked, then retry.

[udi-mosh]

problem solved...
thank you very much. under security, rules and alerts were not checked. once enabled them everything came back.
i hope you will fixed this internally for the upcoming version.

thank you for everything