Help! SecurityOnion not generating alerts after troubleshooting

[rinaching609]

Version

2.4.190

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

airgap

Hardware Specs

Does not meet minimum requirements

CPU

8

RAM

16

Storage for /

200

Storage for /nsm

not sure

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

My securityonion is hosted on a laptop on vmware workstation. Im using it to detect simulated attacks on various virtual machines on different laptops. Im unable to get any alerts.

Current Setup:

• 3 laptops: one runs SO, others host server VMs, windows 10 and attacker Kali instances.
• Switch is on SPAN mode.
• Physical connection to Cisco Catalyst 2950 Managed switch via Ethernet cable; VMs in bridged mode (able to ping each other).
  Internal IP addresses: IP addresses: switch: 192.168.204.3, security onion: 192.168.204.69, windows 10 workstation: 192.168.204.75, web server (ubuntu): 192.168.204.71.
• Host machine with SO has 2 bridged custom ethernet connected to the switch, one for management, one for monitoring (SPAN). It is configured in VMware.

When doing TCP dump on ens192 or bond0, or i can see traffic on it, such as me pinging from one VM to another.

Screenshot of ip addr:

Screenshot of TCP dump on bond0:

Screenshot of sudo nmcli con show:

I have no idea how to fix it, please help me!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

Are you able to see any network logs generated for your traffic? Example review Dashboards -> 'Connections seen by Zeek or Suricata'