From 224bc6b4291de8bf36fcbebc3766933908f51b24 Mon Sep 17 00:00:00 2001 From: weslambert Date: Fri, 16 Aug 2024 14:15:10 -0400 Subject: [PATCH] Ignore old SOC logs before licenseStatus --- salt/common/tools/sbin/so-log-check | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/common/tools/sbin/so-log-check b/salt/common/tools/sbin/so-log-check index 3d019fb41..c5bc4d1f2 100755 --- a/salt/common/tools/sbin/so-log-check +++ b/salt/common/tools/sbin/so-log-check @@ -206,6 +206,7 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then EXCLUDED_ERRORS="$EXCLUDED_ERRORS|detect-parse" # Suricata encountering a malformed rule EXCLUDED_ERRORS="$EXCLUDED_ERRORS|integrity check failed" # Detections: Exclude false positive due to automated testing EXCLUDED_ERRORS="$EXCLUDED_ERRORS|syncErrors" # Detections: Not an actual error + EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Provided Grok expressions do not match field value: [unprovisioned] # SOC log: before fields.status was changed to fields.licenseStatus fi RESULT=0