0.27.0

0.27.0 - 2026-07-19

Added

• Automatic database retention can now be disabled for the server with
  --disable-retention, allowing older imported events to remain available for
  inspection.
• The server's default browser time range can now be configured with
  --default-time-range, EVEBOX_DEFAULT_TIME_RANGE, or the
  defaults.time-range configuration key.
• evebox oneshot --pcap can process one or more local PCAP files with
  containerized Suricata before loading the generated EVE events. On Linux
  it uses local Podman or Docker with ET/Open, PAW Patrules, and The Hunters
  Ledger rules.
• Oneshot mode shows compact event-type count cards above the event list for
  quickly reviewing and filtering imported events.
• Event and custom packet captures can now be downloaded from a Suricata
  pcap-log spool directory on the EveBox server.
• New evebox pcap extract command extracts packets from capture spools by
  time range and libpcap filter expression. A port from dumpy.
• New evebox pcap purge command removes old capture files by retained file
  count or total size, with dry-run and periodic operation support. A port from
  dumpy.
• EveBox agents can serve packet captures from remote Suricata pcap-log
  spool directories, even when the EveBox server runs on Windows. Requests
  routed to an unresponsive agent fail quickly.
• Per-agent keys can authenticate persistent agent connections and be managed
  through the CLI or Agents administration page.
• New Agents administration page lists connected agents and manages agent
  keys and packet capture routing.
• Packet capture routing rules map sensors to local or remote capture sources,
  with support for an optional default source.
• The event PCAP menu can download from a specific capture source, bypassing
  automatic source selection.

Changed

• Event descriptions now show more useful protocol-specific details for FTP,
  RDP, SNMP, TFTP, SMTP, MQTT, IKE, and LLMNR events.
• With its default wait behavior, oneshot mode now exits with an error when
  the input can't be imported, for example an unreadable file or malformed
  EVE JSON, instead of opening the event viewer with partial or no data.
  --no-wait retains its asynchronous behavior and logs later import failures.
• Oneshot mode now opens the Events view instead of the Inbox by default.
• Building from source now requires libpcap development headers on
  non-Windows platforms for the packet capture features. Linux release
  binaries remain fully static and bundle a static libpcap.

Fixed

• The Inbox sensor selector now stays synchronized with the sensor in the URL
  when opening direct links or using browser back navigation.
• Stats events without capture counters can now be opened in the event view.
• Oneshot mode now resets the browser's time range to show all imported events
  when the page is first loaded.
• The oneshot --limit option was silently ignored; it now limits the number
  of events imported as documented.
• Oneshot mode no longer silently stops the import at a blank line, and no
  longer drops the final event of an EVE file without a trailing newline. A
  truncated final line is skipped with a warning.
• eve2pcap: the seconds field of pcap record headers was written from the
  wrong timestamp value, giving packets in downloaded pcap files bogus
  capture times.
• eve2pcap: downloads were served with a misspelled Content-Type of
  application/vnc.tcpdump.pcap; it is now the correct
  application/vnd.tcpdump.pcap.