Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search
TypeScript Go HTML Shell Makefile CSS JavaScript
Permalink
Failed to load latest commit information.
.travis travis: merge stable,unstable,jessie,stretch Feb 23, 2017
cmd esimport: fix redirect handling for post Feb 11, 2017
config backend: more go reorg Nov 3, 2016
core copyright headers Dec 3, 2016
deb quote systemd environment files Jul 8, 2016
docker/evebox docker: fix docker build Jan 10, 2017
elasticsearch es: log path to template Feb 14, 2017
eve copyright headers Dec 3, 2016
evereader copyright headers Dec 3, 2016
geoip copyright headers Dec 3, 2016
http esimport: fix redirect handling for post Feb 11, 2017
log cleanup archiving with the scroll api Oct 17, 2016
pcap more go reorg into packages Nov 2, 2016
postgres copyright headers Dec 3, 2016
resources handle static file request with query params... Jan 9, 2017
rpm quote systemd environment files Jul 8, 2016
server custom error for failure to connect to elastic search Dec 22, 2016
sqlite copyright headers Dec 3, 2016
util custom error for failure to connect to elastic search Dec 22, 2016
webapp webapp: update angular to 2.4.0 Jan 18, 2017
.dockerignore travis: fixups Aug 19, 2016
.gitignore build: new resource handling Nov 30, 2016
.travis.yml travis: use node 6.9.4 Jan 17, 2017
Dockerfile dockerfile: don't install ruby/fpm twice Oct 11, 2016
LICENSE.txt frontend: port to angular 2 Jul 6, 2016
Makefile travis/bintray: fix inner name of "latest" packages Jan 9, 2017
README.md README: update build instructions. Oct 26, 2016
evebox-example.yaml esimport: better config defaults Oct 10, 2016
glide.lock custom error for failure to connect to elastic search Dec 22, 2016
glide.yaml custom error for failure to connect to elastic search Dec 22, 2016
pgctl.sh pgctl.sh: dev tool for starting/stopping postgres Nov 22, 2016

README.md

Build Status Download

EveBox

EveBox is a web based Suricata "eve" event viewer for Elastic Search.

EveBox

Requirements

  • Suricata, Logstash and Elastic Search (Elastic Search 2.0 or newer).
  • A modern browser.

Installation.

Download a package and run the evebox application.

Example:

./evebox -e http://localhost:9200

Then visit http://localhost:5636 with your browser.

Up to date builds can be found here: https://bintray.com/jasonish/evebox-development/evebox/_latestVersion#files

This should not require any modification to your Elastic Search configuration. Unlike previous versions of Evebox, you do not need to enable dynamic scripting and CORS.

Docker

If you wish to install EveBox with Docker an up to date image is hosted on Docker hub.

Example:

docker pull jasonish/evebox
docker run -it -p 5636:5636 jasonish/evebox -e http://elasticsearch:9200

replacing your http://elasticsearch:9200 with that of your Elastic Search URL. You most likely do not want to use localhost here as that will be the localhost of the container, not of the host.

OR if you want to link to an already running Elastic Search container:

docker run -it -p 5636:5636 --link elasticsearch jasonish/evebox

Then visit http://localhost:5636 with your browser.

This should not require any modification to your Elastic Search configuration. Unlike previous versions of Evebox, you do not need to enable dynamic scripting and CORS.

Building EveBox

EveBox consists of a JavaScript frontend, and a very minimal backend written in Go. To build Evebox the following requirements must first be satisfied:

  • Node.js v6.5.0 or newer installed.
  • A working Go 1.7 installation and GOPATH.

First checkout Evebox into your GOPATH, for example:

git clone https://github.com/jasonish/evebox.git \
    $GOPATH/src/github.com/jasonish/evebox

If this is the first build the npm and Go dependencies must be installed, this can be done with:

make install-deps

install-deps will also upgrade any dependencies, so its a good idea to re-run after git pulls.

Then to build the binary:

make

Or to build a release:

make release

If you don't want to bother with the required development tools, but do have Docker installed, you can build a release with the following command:

make release-with-docker`

Run in Development Mode

ELASTICSEARCH_URL=http://localhost:9200 make dev-server

Where the ELASTICSEARCH_URL is pointing to your Elastic Search server.

License

BSD.