Skip to main content

EveCtl - Suricata & EveBox Launcher/Controller/Manager Whatever

EveCtl is a tool to help easily manage Suricata and EveBox on Linux and Windows. On Linux it runs the components in containers with Docker or Podman. On Windows it manages native Suricata, EveBox, and Npcap installations.

It supports standalone installs and more advanced use cases such as:

  • Using a bundled (containerized) Elasticsearch server, or an external Elasticsearch server if you already have one.
  • EveBox Server only mode, if you wish to separate the server side from the sensors.
  • Agent mode which runs Suricata and uses the EveBox Agent to send events to an EveBox server.

EveCtl is still experimental.

System Requirements​

The machine needs a network interface that sees the traffic you want to monitor. In the simplest scenario, this can be the primary network interface, which sees traffic to and from the machine itself.

Linux​

  • An x86_64 or Arm64 Linux system with Docker or Podman.
  • Root access, which Suricata requires for low-level access to network interfaces.

Windows​

  • 64-bit Windows on an x86_64 processor.
  • PowerShell and permission to approve installer elevation prompts.

Installation​

Linux​

Install EveCtl with the following command:

curl -sSf https://evebox.org/evectl.sh | sh

The installer verifies your platform, downloads evectl, and asks where to install it:

  • ~/.local/bin (recommended): a per-user install that does not require sudo. This directory is on the PATH by default on most Linux distributions.
  • /usr/local/bin: a system-wide install that requires sudo.

To skip the prompt, set EVECTL_INSTALL_DIR, for example:

curl -sSf https://evebox.org/evectl.sh | EVECTL_INSTALL_DIR=/usr/local/bin sh

Configuration and data files are stored in ~/.config/evebox. Run EveCtl with:

evectl

Windows PowerShell​

Install EveCtl with the PowerShell equivalent of the Linux curl command:

irm https://evebox.org/evectl.ps1 | iex

The installer verifies the download, installs evectl.exe in $env:LOCALAPPDATA\evectl\bin, and offers to add that directory to your user PATH. Run it with:

evectl.exe

You can also download EveCtl directly from https://evebox.org/files/evectl/.

On first run, follow the setup wizard and select the network interface to monitor. Select "Start" from the main menu, then point your browser at http://127.0.0.1:5636.

External Access

If running EveCtl on a firewall, router, or server, you may want to explore the menu options for enabling external access.

GitHub, Questions, etc...​

For more current information, or to ask a question see the GitHub project for EveCtl: