Same error as earlier with the SIEM rules lab. “Cannot destructure property ‘userPassword’ of ‘o’ as it is undefined.”
Sorry for making a third post on the front page related to this issue, but so far there’s been no response and I’m unaware of how to submit a support ticket.
Thanks,
edit: Randomly retried the lab again and was able to do most of it. So, if you’re experiencing the Cannot destructure property error maybe just check back from time to time. That being said, I’m still experiencing another issue I had earlier where the wazuh-archives* index is not available.
Sorry for the 'userPassword" error, this is some new thing they are looking into. They got a handle on the ‘Error 400’ issue (hooray) but this might be a side effect.
I launched the lab a few times and I was able to see wazuh-archives-* index each time:
The note in the lab does say to hit refresh if for some reason you don’t see the wazuh-archives-* index. They mean the blue Refresh button not refresh the web page.
HOWEVER… I do not think this is the correct lab step as I cannot find the right fields (e.g. data.srcip) in the wazuh-archives-* index, but I DO find them in the wazuh-alerts-* index.
FYI: Support issues can be emailed to support@cybrary.it
I will touch bases with the lab writer and get back to this group.
Thank you for the reply and the additional support email address. I’ll go through and try the previous labs again. It appears I may have been trying to change the index pattern in the wrong area. Thank you.
I have the same issue. I cannot see data.srcip, data.url, data.id under Available fields within wazuh-archives-*. Please fix this issue, otherwise the guided exercise cannot be proceed.
Hey there - this is an intermittent issue with Wazuh. The workaround is noted in the instructions after Part 5, Step 13 - Note: If you don’t see the data.srcip field in the Available fields list (or any other fields in the following steps), click the Reload button on the browser toolbar.
I’ve encountered this behavior in Wazuh a few times myself. So far, this workaround has solved it for me, but please let us know if it doesn’t work for you.
@CalmQuail2332 Thank you!
Yes, I saw that note in Part 5, Step 13. But I tried many times to click the Reload button on the browser toolbar. Today I tried it again, but still no good.
Thanks for the update - we’ll run another pass on this today.
Okay, we’ve got a fix in place. We reshuffled some of the instructions to sidestep the issue with certain fields not appearing on the left.
1 Like
