0.26.0

0.26.0 - 2026-07-03

Added

• Alerts can now be filtered by state from the search box with is:archived
  and is:escalated, negatable as -is:archived and -is:escalated. This
  works with the SQLite, Elasticsearch, and OpenSearch datastores.
• New evebox test elastic command (aliased evebox test opensearch) that
  loads a sample of EVE events into a throwaway index and exercises the queries
  and mutations EveBox runs in normal operation, to check supported
  Elasticsearch/OpenSearch backend behavior.
  • The throwaway index uses a unique per-run prefix, so its queries,
    mutations, and cleanup can only ever touch indices it created.
  • --existing runs read-only against an existing backend (no imports,
    mutations, or deletions), making it safe against a production cluster.
  • A backend test harness for SQLite and containerized
    Elasticsearch/OpenSearch versions lives in testing/backends/.
  • A companion evebox test sqlite command runs equivalent behavioral checks
    against a throwaway SQLite database.
• New evebox check-update command and a "Check for updates" button in the web
  UI's About dialog that report whether a newer EveBox release is available.
  • The check is always user initiated; EveBox never contacts the update server
    on its own.
  • The web UI fetches a small release manifest
    (https://evebox.org/files/release/latest.json) directly, without going
    through the EveBox server.
• The Help dialog now includes a "Search Queries" tab with examples for common
  search terms, shorthand fields, time filters, alert-state filters, and
  negation.

Changed

• On OpenSearch, stats events are now indexed into a separate
  {index}-stats-YYYY.MM.DD index instead of the main daily event index.
  • This keeps the large number of stats.* counter fields out of the main
    event index mapping. Only newly created indices are affected; stats already
    stored in existing {index}-YYYY.MM.DD indices stay where they are and are
    aged out normally by retention.
  • Stats queries continue to search the full {index}-* pattern, so stats in
    both the new and the legacy indices remain visible, and index retention
    covers the new stats indices automatically.
  • This applies to OpenSearch only; Elasticsearch keeps everything in the
    single daily index. The split is also skipped in date-less index mode.
• The admin index management page now groups indices by date (with per-date doc
  and store-size subtotals and human-readable sizes), and labels the datastore
  as OpenSearch or Elasticsearch based on the actual backend.
  • Deletion now operates on whole days: a single "Delete Day" button removes
    all of a day's indices (events and stats) together, replacing the
    per-index delete buttons. Indices without a date in their name keep
    individual delete buttons.
• Unsupported Elasticsearch and OpenSearch versions now abort startup instead of
  only logging a warning and continuing.
  • EveBox requires Elasticsearch 7.10 or newer, or OpenSearch 2.6.0 or newer.
• Elasticsearch versions older than 8.19.0 now log/display a warning that
  EveBox may not work correctly.

Fixed

• The @ip and @mac search filters now work in the SQLite alert search, not
  just the event search. Previously they silently matched nothing on the alerts
  view.
• SQLite alert searches now support @from and @after time filters,
  matching the existing @to and @before support.
• The event JSON view now renders valid JSON, with quoted field names and no
  trailing commas.
• Stopped using deprecated OpenSearch inline script fields for tag/history
  updates.

Technical Updates

• Updated Rust dependencies.
• Updated Suricata rule parsing to use the published
  suricatax-rule-parser scanner API.
• Dropped the unused hickory-dns feature from reqwest.