EveBox 0.27.0 has been released. This release adds two major packet capture workflows: analyzing local captures in oneshot mode and retrieving full packet captures from capture spools.

Analyze PCAPs in Oneshot Mode​

On Linux, EveBox can now process one or more local PCAP or PCAPNG files:

evebox oneshot --pcap capture.pcap

EveBox uses a local Podman or Docker container to run Suricata, updates ET/Open, PawPatRules, and The Hunters Ledger rules, imports the generated EVE events, and opens them for review. Compact event-type count cards make it easy to see what Suricata found and filter the results.

The capture is processed locally and is not uploaded to a remote service. See Try EveBox for requirements and additional options.

Retrieve Full Packet Captures​

The EveBox web interface can now retrieve full packet captures for an event directly from a rotated capture spool, such as one written by Suricata's pcap-log output. Captures can also be requested for a custom time range and BPF filter.

The spool can be local to the EveBox Server or served by an EveBox Agent on a remote sensor. The new Administration → Agents page manages agent keys, connected capture sources, and routing rules that map event sensors to the correct source. This also lets an EveBox Server running on Windows retrieve captures through remote Linux agents.

New evebox pcap extract and evebox pcap purge commands provide direct command-line extraction and retention management for capture spools. See the packet capture documentation for setup details.

Other Highlights​

• Server database retention can now be disabled when older events need to remain available.
• The default browser time range can now be configured.
• Oneshot mode now opens the Events view and reports import failures instead of silently opening with partial or no data.
• Event descriptions include more useful details for several additional protocols.

Download EveBox 0.27.0 from the downloads page.

EveBox 0.26.0 has been released with new search filters, backend compatibility checks, update checking, and Elasticsearch/OpenSearch improvements.

Search and Help Improvements​

Alert searches can now filter by state directly from the search box:

• is:archived and -is:archived
• is:escalated and -is:escalated

These filters work with SQLite, Elasticsearch, and OpenSearch. The web UI Help dialog also has a new Search Queries tab with examples for common searches, shorthand fields, time filters, alert-state filters, and negation.

SQLite alert searches also gained support for @ip, @mac, @from, and @after, bringing alert search behavior closer to event search.

Backend and Update Checks​

A new evebox test elastic command, also available as evebox test opensearch, can load a sample of EVE events into a throwaway index and exercise the queries and mutations EveBox uses in normal operation. Use --existing to run read-only checks against an existing backend.

A companion evebox test sqlite command runs equivalent checks against a throwaway SQLite database.

This release also adds evebox check-update and a Check for updates button in the web UI About dialog. Update checks are always user initiated; EveBox does not contact the update server on its own.

Elasticsearch and OpenSearch​

On OpenSearch, stats events are now indexed into a separate {index}-stats-YYYY.MM.DD index instead of the main daily event index. This keeps large stats.* counter mappings out of the main event index. Existing stats remain visible and age out normally.

The admin index management page now groups indices by date, shows per-date document and size totals, and deletes whole days at a time for date-based indices.

EveBox now aborts startup on unsupported Elasticsearch/OpenSearch versions. Elasticsearch 7.10 or newer and OpenSearch 2.6.0 or newer are required. Elasticsearch versions older than 8.19.0 now show a warning.

Fixes and Maintenance​

• The event JSON view now renders valid JSON
• Deprecated OpenSearch inline script fields are no longer used for tag/history updates
• Rust dependencies and Suricata rule parsing support were updated

EveBox 0.25.0 has been released.

This release includes alert navigation fixes and a small refresh button loading state improvement.

Fixed​

• Preserved alert list state when returning from an alert detail page with browser history
• Avoided showing an empty inbox after navigating away from an alert detail page and then going back

Changed​

• Improved refresh button loading state handling

EveBox 0.24.0 has been released with improvements to event filtering, dashboard controls, and SQLite importing.

New and Improved​

• Added a sensor selector to the Events page
• Added support for importing xz-compressed EVE JSON files with the SQLite CLI importer
• Refined the Events page filter controls and layout
• Unified the Dashboard refresh control layout and button styling
• Made --config-directory a global CLI argument

SQLite Import Performance​

The SQLite importer now uses a faster tokenizer for printable payload fields. It extracts ASCII words directly, skips base64 and HTTP response body data where appropriate, and avoids regex overhead during ingest.

Fixes and Maintenance​

This release also lowers the log level for lines not ending with a newline, removes stray SQLite retention debug logging, updates Rust and webapp dependencies, and removes the older rusqlite SQLite importer implementation.

EveBox 0.23.0 has been released.

This is a maintenance release that updates dependencies and keeps the release packages current. There are no major user-facing feature changes in this release.

EveBox 0.22.0 has been released. This release focuses on the stats Dashboard, improving both historical navigation and chart usability.

Stats Dashboard​

The stats Dashboard now supports time ranges, making it easier to review historical Suricata stats instead of only looking at the most recent window.

Highlights include:

• Date navigation for browsing historical time windows
• A visible selected time range in the UI
• Multi-sensor support with per-sensor line graphs
• Additional charts for flow active, flow total, flow spare, and TCP reassembly memory
• Synchronized chart crosshairs for easier comparison across graphs

Performance​

HTTP requests made by the server and agent now use the Hickory DNS resolver. This avoids repeated system resolver lookups, adds internal DNS caching, and can help agents sending larger batches of events.

SQLite sensor queries were also optimized to reduce unnecessary work.

Other Changes​

This release also improves chart color consistency, simplifies the stats API, updates EveBox to Rust edition 2024, and raises the Rust MSRV to 1.85.0.

I'm pleased to announce the release of EveBox 0.21.0, featuring API improvements, performance optimizations, and important fixes.

Key Changes​

API Simplification

• Streamlined API routes by removing version prefix (/api/1/* → /api/*)
• Legacy /api/1/submit endpoint preserved for backward compatibility

Agent Improvements

• Default data directory changed to /var/lib/evebox for systemd service
• Prevents bookmark files from being created in root directory

Performance

• Optimized server processor efficiency by replacing sleep(0) with yield_now()
• Improved CPU utilization and reduced unnecessary spinning

Fixes

• Fixed Debian package installation by ensuring /var/lib/evebox directory creation
• Resolves issues when using EVEBOX_DATA_DIRECTORY=/var/lib/evebox

Technical Updates

• Updated to latest Axum web framework
• Rust MSRV updated to 1.82.0
• Updated dependencies including nom parser v8 and maxminddb

EveBox 0.20.5 has been released with improved support for Suricata mDNS events.

Added​

• Added mDNS cards to the Address dashboard
• Added mDNS to the Events page event-type selector
• Added formatting for mDNS event descriptions

EveBox 0.20.4 has been released with dashboard improvements, a new packet capture utility, and Elasticsearch fixes.

New and Improved​

• Added top source and destination IP cards to the Overview dashboard
• Added the eve2pcap command-line utility
• Added clearer prefixes to badges in the Alerts view
• Updated dashboard components to use Bootstrap directly

Fixed​

• Increased the Elasticsearch sensor aggregation limit from 10 to 1000 (issue #335)
• Fixed aggregation values by consistently converting them to strings
• Truncated long sensor names where needed on the DHCP dashboard

EveBox 0.20.3 has been released with new retention controls for Elasticsearch and SQLite, along with several web interface fixes.

Elasticsearch Index Management​

Administrators can now view and manually delete Elasticsearch indices from the web interface. EveBox can also automatically delete dated indices older than a configured number of days.

This adds the date-based retention policy requested in issue #258.

SQLite Retention​

SQLite age- and size-based retention settings are now available from the Admin page, making it possible to manage database growth without editing the configuration file.

Fixed​

• Allowed periods in event comments without interfering with the comment form
• Preserved a query timeout value of zero in local storage
• Fixed disabling query timeouts by setting the value to zero