From 224bc6b4291de8bf36fcbebc3766933908f51b24 Mon Sep 17 00:00:00 2001 From: weslambert Date: Fri, 16 Aug 2024 14:15:10 -0400 Subject: [PATCH 1/2] Ignore old SOC logs before licenseStatus --- salt/common/tools/sbin/so-log-check | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/common/tools/sbin/so-log-check b/salt/common/tools/sbin/so-log-check index 3d019fb41..c5bc4d1f2 100755 --- a/salt/common/tools/sbin/so-log-check +++ b/salt/common/tools/sbin/so-log-check @@ -206,6 +206,7 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then EXCLUDED_ERRORS="$EXCLUDED_ERRORS|detect-parse" # Suricata encountering a malformed rule EXCLUDED_ERRORS="$EXCLUDED_ERRORS|integrity check failed" # Detections: Exclude false positive due to automated testing EXCLUDED_ERRORS="$EXCLUDED_ERRORS|syncErrors" # Detections: Not an actual error + EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Provided Grok expressions do not match field value: [unprovisioned] # SOC log: before fields.status was changed to fields.licenseStatus fi RESULT=0 From 205bbd9c61078bd307edb77e8e663c36137e6918 Mon Sep 17 00:00:00 2001 From: weslambert Date: Fri, 16 Aug 2024 14:31:11 -0400 Subject: [PATCH 2/2] Use more specific match --- salt/common/tools/sbin/so-log-check | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/common/tools/sbin/so-log-check b/salt/common/tools/sbin/so-log-check index c5bc4d1f2..8f7e29d51 100755 --- a/salt/common/tools/sbin/so-log-check +++ b/salt/common/tools/sbin/so-log-check @@ -206,7 +206,7 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then EXCLUDED_ERRORS="$EXCLUDED_ERRORS|detect-parse" # Suricata encountering a malformed rule EXCLUDED_ERRORS="$EXCLUDED_ERRORS|integrity check failed" # Detections: Exclude false positive due to automated testing EXCLUDED_ERRORS="$EXCLUDED_ERRORS|syncErrors" # Detections: Not an actual error - EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Provided Grok expressions do not match field value: [unprovisioned] # SOC log: before fields.status was changed to fields.licenseStatus + EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Provided Grok expressions do not match field value\\: \\[unprovisioned\\]" # SOC log: before fields.status was changed to fields.licenseStatus fi RESULT=0