0.28.0

0.28.0 - 2026-08-14

Added

• EVE inputs now support timestamped Suricata spools named
  eve.json.<timestamp> or eve.json.<thread>.<timestamp>, with one processor
  per logical thread stream. Processed spool files can optionally be deleted
  with input.delete-spool-files.
• EveBox server and agent inputs can create Unix stream or datagram sockets
  for Suricata EVE output, avoiding an intermediate EVE log file. Configure
  input.sockets with a path and a unix_stream or unix_dgram type.
• Oneshot PCAP mode can now use a locally installed Suricata instead of a
  container. Rules are downloaded with suricata-update when available, or
  directly from the supported rule feeds when it is absent, with downloads
  cached in EveBox's cache directory. The local backend is the default on
  Windows and is selected on Linux with --suricata-backend local or
  --suricata, and is also used on Linux as a fallback when no usable
  container runtime is found. Configuration, rules, and logs are generated
  in a temporary workspace, leaving the installed Suricata configuration
  untouched. The generated configuration enables all protocol loggers,
  including those disabled by default in Suricata, with extended logging
  and file hashing enabled. On Windows, rules using the file.magic or
  filemagic keywords are removed when assembling the ruleset, as the
  Windows Suricata builds do not support them. Windows supports analysis and
  event import, but not packet extraction from the input PCAP.
• Oneshot mode can now read EVE events from stdin by using - as the
  input, for example: curl https://example.com/eve.json | evebox oneshot -.
  Events are imported as they arrive rather than waiting for end of input.
  #374
• New DNS dashboard with summary cards for query volume, NXDOMAIN and
  SERVFAIL rates, and distinct clients and servers seen, plus DNS
  activity over time, the most and least requested names, top clients
  and servers, and top NXDOMAIN names and clients.
• The Alerts dashboard adds summary cards for alert volume, counts by
  severity, and distinct signatures seen, plus alert categories and
  alerting protocols tables.
• The Overview dashboard adds summary cards for event volume, alert
  count and share, and the distinct event types and sensors seen.
• New Anomalies dashboard for Suricata protocol parser and decoder
  anomalies, with summary cards, anomaly activity over time, and
  breakdowns by anomaly event, affected application protocol, type,
  layer, and top sources and destinations.

Changed

• Auto-archive filters can now match exact DNS query names and TLS SNI values.
  Filters are applied after event enrichment and to matching alerts indexed
  outside EveBox, and alert history identifies the cause of automatic
  archival. Existing filters are migrated automatically to the new flexible
  condition format.
• The admin pages now share a common layout with sidebar navigation
  between the admin sections (General, Elasticsearch/OpenSearch index
  management, Agents, and Filters), replacing the previous ad-hoc links,
  and each page has a consistent header describing the section.
• Oneshot PCAP processing no longer aborts when individual rules fail to
  load. Suricata now logs and skips such rules, and processing continues
  with the rules that did load.
• In oneshot mode, CTRL-C while events are still being imported now stops
  the import, keeping the events read so far for review. A further CTRL-C
  exits.
• The oneshot database is now created in the EveBox cache directory instead
  of the current directory, and stale database files left behind by a
  previous run are removed on startup. Previously, on Windows, the database
  could not be removed on exit and a later run would also show the previous
  run's events.

Fixed

• Empty bookmark files left by input startup checks are now ignored instead of
  being reported as invalid bookmarks.
• SQLite full-text searches no longer match text found only in alert history.