diff --git a/salt/common/tools/sbin/so-nsm-clear b/salt/common/tools/sbin/so-nsm-clear index 3d9596238..c9e5e86d2 100755 --- a/salt/common/tools/sbin/so-nsm-clear +++ b/salt/common/tools/sbin/so-nsm-clear @@ -41,8 +41,13 @@ done if [ $SKIP -ne 1 ]; then # Inform user we are about to delete all data echo - echo "This script will delete all NIDS data (PCAP, Suricata, Zeek)" - echo "If you would like to proceed, please type "AGREE" and hit ENTER." + echo "This script will delete all NSM data from /nsm." + echo + echo "This includes Suricata data, Zeek data, and full packet capture (PCAP)." + echo + echo "This will NOT delete any Suricata or Zeek logs that have already been ingested into Elasticsearch." + echo + echo "If you would like to proceed, then type AGREE and press ENTER." echo # Read user input read INPUT @@ -54,8 +59,8 @@ delete_pcap() { [ -d $PCAP_DATA ] && so-pcap-stop && rm -rf $PCAP_DATA/* && so-pcap-start } delete_suricata() { - SURI_LOG="/opt/so/log/suricata/eve.json" - [ -f $SURI_LOG ] && so-suricata-stop && rm -f $SURI_LOG && so-suricata-start + SURI_LOG="/nsm/suricata/" + [ -d $SURI_LOG ] && so-suricata-stop && rm -rf $SURI_LOG/* && so-suricata-start } delete_zeek() { ZEEK_LOG="/nsm/zeek/logs/" diff --git a/salt/elasticsearch/tools/sbin/so-elastic-clear b/salt/elasticsearch/tools/sbin/so-elastic-clear index 085327fc4..af7b91ce2 100755 --- a/salt/elasticsearch/tools/sbin/so-elastic-clear +++ b/salt/elasticsearch/tools/sbin/so-elastic-clear @@ -67,7 +67,7 @@ if [ $SKIP -ne 1 ]; then echo echo "This script will delete all data (documents, indices, etc.) in the Elasticsearch database." echo - echo "If you would like to proceed, please type "AGREE" and hit ENTER." + echo "If you would like to proceed, then type AGREE and press ENTER." echo # Read user input read INPUT diff --git a/salt/manager/tools/sbin_jinja/so-elastic-fleet-reset b/salt/manager/tools/sbin_jinja/so-elastic-fleet-reset index 564156af9..f1112c723 100644 --- a/salt/manager/tools/sbin_jinja/so-elastic-fleet-reset +++ b/salt/manager/tools/sbin_jinja/so-elastic-fleet-reset @@ -18,7 +18,7 @@ echo "This includes data previously ingested with Fleet such as Zeek and Suricat echo "Deployed Elastic Agents will no longer be enrolled and will need to be reinstalled." echo "This script should only be used as a last resort to reinstall Elastic Fleet." echo -echo "If you would like to proceed, type AGREE and hit ENTER." +echo "If you would like to proceed, then type AGREE and press ENTER." echo # Read user input read INPUT @@ -93,4 +93,4 @@ so-elastic-fleet-setup status "Re-installing Elastic Agent on all Grid Nodes..." salt \* state.apply elasticfleet.install_agent_grid queue=True -status "Elastic Fleet Reset complete...." \ No newline at end of file +status "Elastic Fleet Reset complete...."