Okay, so first... the nature of this is tricky. Now, here's what's going on: On upgrade, ES will re-enable the enforcement of Data Model Acceleration settings. So even though it was disabled prior to upgrade, we flip it back on for you. The reason being because it was sort of a safeguard as a number of searches depend on it. Annoying, yes. The proper way to disable acceleration is to uncheck the acceleration box for your Data Model, but leave enforcement enabled. Essentially, we're saying, enforce a value of acceleration=false. This will persist should you upgrade ES again. ... View more

Were the Data Model Acceleration Enforcement Settings still enabled prior to upgrade? It's strange that your local settings are getting overwritten. ... View more

jhall0007- Thanks for mentioning this. This is a known problem and will be addressed. While placing the lookups in a new app works, the problem is that the app blacklists the sample lookups in distsearch.conf. However, it's overzealous and blacklists ALL the lookups. 🙂 Out of the box: excludeSSE1 = ...Splunk_Security_Essentials_for_Ransomware/lookups... excludeSSE2 = ...Splunk_Security_Essentials_for_Ransomware\lookups... Fix: excludeSSE1 = ...Splunk_Security_Essentials_for_Ransomware/lookups/UC... excludeSSE2 = ...Splunk_Security_Essentials_for_Ransomware\lookups\UC.. ... View more

If you are using online mode found in Opsec 2.1+, lea-loggrabber will not retrieve the older data. It indexes the live stream of logs. If you are not using online mode, then like mreynov said, the logs should be pulled in automatically. ... View more

Hi, Can you give us some more info on the output of your debug? ./lea-loggrabber-debug.sh --configentity {checkpoint connection} --debug-level 3 ... View more

If your checkpoint is using sslca_clear, you can manually change your opsec.conf attribute of an existing connection to the following and it should work. lea_server_auth_type = sslca_clear ... View more