Blason R's questions

Surprisingly my elastic version 7.15 with basic license have installed the fleet server and then configured windows-policy with elastic-endpoint and windows integration. Have enabled all the rules; however I am not seeing any logs security app. I am specifically using feet server to enroll agents and collecting windows logs. Have added windows agent on my Domain controller as well as ADC but still not seeing any logs.

Any clue why? Plus I am seeing below logs in kibana.log consistently.

{"type":"log","@timestamp":"2021-10-07T22:43:49+05:30","tags":["info","plugins","securitySolution"],"pid":1102,"message":"[+] Finished indexing 0  signals searched between date ranges [\n  {\n    \"to\": \"2021-10-07T17:13:49.667Z\",\n    \"from\": \"2021-10-07T17:04:49.667Z\",\n    \"maxSignals\": 100\n  }\n] name: \"SystemKey Access via Command Line\" id: \"c2c1fbc1-229f-11ec-803f-17c1b2345c64\" rule id: \"d75991f2-b989-419d-b797-ac1e54ec2d61\" signals index: \".siem-signals-default\""}
{"type":"log","@timestamp":"2021-10-07T22:43:49+05:30","tags":["error","plugins","securitySolution"],"pid":1102,"message":"An error occurred during rule execution: message: \"index_not_found_exception: [verification_exception] Reason: Found 1 problem\nline -1:-1: Unknown index [*,-*]\" name: \"Clearing Windows Event Logs\" id: \"c2c1fbd5-229f-11ec-803f-17c1b2345c64\" rule id: \"d331bbe2-6db4-4941-80a5-8270db72eb61\" signals index: \".siem-signals-default\""}
 {"type":"log","@timestamp":"2021-10-07T23:21:53+05:30","tags":["error","plugins","securitySolution"],"pid":10188,"message":"An error occurred during rule execution: message: \"index_not_found_exception: [verification_exception] Reason: Found 1 problem\nline -1:-1: Unknown index [*,-*]\" name: \"Suspicious PrintSpooler Service Executable File Creation\" id: \"c2c2710c-229f-11ec-803f-17c1b2345c64\" rule id: \"5bb4a95d-5a08-48eb-80db-4c3a63ec78a8\" signals index: \".siem-signals-default\""}
{"type":"log","@timestamp":"2021-10-07T23:21:53+05:30","tags":["error","plugins","securitySolution"],"pid":10188,"message":"An error occurred during rule execution: message: \"index_not_found_exception: [verification_exception] Reason: Found 1 problem\nline -1:-1: Unknown index [*,-*]\" name: \"Unusual File Creation - Alternate Data Stream\" id: \"c2c41eb3-229f-11ec-803f-17c1b2345c64\" rule id: \"71bccb61-e19b-452f-b104-79a60e546a95\" signals index: \".siem-signals-default\""}
{"type":"log","@timestamp":"2021-10-07T23:21:53+05:30","tags":["error","plugins","securitySolution"],"pid":10188,"message":"An error occurred during rule execution: message: \"index_not_found_exception: [verification_exception] Reason: Found 1 problem\nline -1:-1: Unknown index [*,-*]\" name: \"Persistence via WMI Standard Registry Provider\" id: \"c2c445ba-229f-11ec-803f-17c1b2345c64\" rule id: \"70d12c9c-0dbd-4a1a-bc44-1467502c9cf6\" signals index: \".siem-signals-default\""}
{"type":"log","@timestamp":"2021-10-07T23:21:53+05:30","tags":["error","plugins","securitySolution"],"pid":10188,"message":"An error occurred during rule execution: message: \"index_not_found_exception: [verification_exception] Reason: Found 1 problem\nline -1:-1: Unknown index [*,-*]\" name: \"Microsoft Exchange Worker Spawning Suspicious Processes\" id: \"c2c445b7-229f-11ec-803f-17c1b2345c64\" rule id: \"f81ee52c-297e-46d9-9205-07e66931df26\" signals index: \".siem-signals-default\""}
{"type":"log","@timestamp":"2021-10-07T23:21:53+05:30","tags":["error","plugins","securitySolution"],"pid":10188,"message":"An error occurred during rule execution: message: \"index_not_found_exception: [verification_exception] Reason: Found 1 problem\nline -1:-1: Unknown index [*,-*]\" name: \"Persistence via Microsoft Outlook VBA\" id: \"c2c3345f-229f-11ec-803f-17c1b2345c64\" rule id: \"397945f3-d39a-4e6f-8bcb-9656c2031438\" signals index: \".siem-signals-default\""}
{"type":"log","@timestamp":"2021-10-07T23:21:53+05:30","tags":["error","plugins","securitySolution"],"pid":10188,"message":"An error occurred during rule execution: message: \"index_not_found_exception: [verification_exception] Reason: Found 1 problem\nline -1:-1: Unknown index [*,-*]\" name: \"Persistence via KDE AutoStart Script or Desktop File Modification\" id: \"c2c3f7a8-229f-11ec-803f-17c1b2345c64\" rule id: \"e3e904b3-0a8e-4e68-86a8-977a163e21d3\" signals index: \".siem-signals-default\""}
{"type":"log","@timestamp":"2021-10-07T23:21:53+05:30","tags":["error","plugins","securitySolution"],"pid":10188,"message":"An error occurred during rule execution: message: \"index_not_found_exception: [verification_exception] Reason: Found 1 problem\nline -1:-1: Unknown index [*,-*]\" name: \"Installation of Security Support Provider\" id: \"c2c3344f-229f-11ec-803f-17c1b2345c64\" rule id: \"e86da94d-e54b-4fb5-b96c-cecff87e8787\" signals index: \".siem-signals-default\""}

Here is one more issue I am facing. I have portal running on http://test.example.com:8080/AppWise and http://test.example.com/WebAdmin

Now I diverted that portal through Nginx reverse proxy

here is my config

server {
    listen 8080;
    listen 80;
    server_name test.example.com;
    access_log /var/log/nginx/twprod/access.log;
    error_log /var/log/nginx/twprod/error.log;
    include /etc/nginx/applox/feeds/badips.txt;
    location /AppWise/ {
        client_max_body_size 10m;
        client_body_buffer_size 128k;
        proxy_send_timeout 90;
        proxy_read_timeout 90;
        proxy_buffer_size 128k;
        proxy_buffers 4 256k;
        proxy_busy_buffers_size 256k;
        proxy_temp_file_write_size 256k;
        proxy_connect_timeout 30s;
        proxy_pass http://test.example.com:8080;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    location /WebAdmin/ {
        client_max_body_size 10m;
        client_body_buffer_size 128k;
        proxy_send_timeout 90;
        proxy_read_timeout 90;
        proxy_buffer_size 128k;
        proxy_buffers 4 256k;
        proxy_busy_buffers_size 256k;
        proxy_temp_file_write_size 256k;
        proxy_connect_timeout 30s;
        proxy_pass http://test.example.com:8080;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

The thing is First page open properly and then it asks for username password; this is fine. now after login suddenly I receive 302 and page is diverted to http://test/example.com/Appwise/<...........REST of the URI.....>

10.0.22.99 - - [20/Sep/2021:18:41:05 +0530] "POST /AppWise/servlet/TeamAccess/Login HTTP/1.1" 302 0 "http://test.example.com:8080/AppWise/servlet/TeamAccess/Login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36"
10.0.22.99 - - [20/Sep/2021:18:47:42 +0530] "POST /AppWise/servlet/TeamAccess/Login HTTP/1.1" 302 0 "http://test.example.com:8080/AppWise/servlet/TeamAccess/Login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36"
10.0.22.99 - - [20/Sep/2021:18:51:04 +0530] "POST /AppWise/servlet/TeamAccess/Login HTTP/1.1" 302 0 "http://test.example.com:8080/AppWise/servlet/TeamAccess/Login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36"

I expected for this page to stay at http://test.example.com:8080

I have server whose URL is https://xx.xx.xx.xx/TestPage/ which gets generated as

https://xxxx.xxx.xxx/TestPage/(S(0inoxzi14rxqq1uix1tiyp1t))/index.aspx

Now I have implemented nginx reverse proxy in front of this server and then I have done the config proxy_pass as

proxy_pass https://xxx.ssss.sss.ss/TestPage;

Now if you see after TestPage there is a unique value gets added and then index.aspx however whenever request is passed through nginx I get 502 badgateway.

Wondering how do I pass that unique value through regex?

Please help

here is the location

location /TestPage {
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_send_timeout 90;
proxy_http_version 1.1;
proxy_read_timeout 90;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_connect_timeout 30s;
proxy_pass https://xx.ss.xx.ss/TestPage;
proxy_redirect default;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy "no-referrer-when-downgrade";
}
}