EveBox 0.31.0 has been released. This release shows the related events of a flow in the event view, adds TLS, HTTP, and SSH dashboards, makes agents visible on the Agents page whether or not they serve packet captures or files, and makes field searches on Elasticsearch and OpenSearch much more reliable.

Related Events in the Event View​

The event view has a new Flow card listing the other events Suricata logged for the same flow: app-layer records such as TLS, HTTP, and DNS, file information, and the flow record. A summary line shows the flow's duration, packets and bytes in each direction, application protocol, state, and end reason, and each event's offset from the start of the flow.

A single flow can raise the same alert thousands of times, so alerts are grouped by signature with their count and time span, and runs of identical events are collapsed. Each count links to a search for the grouped events. The card is hidden when an event is the only one in its flow. The same data is available from the API as GET /api/event/{id}/flow.

TLS, HTTP, and SSH Dashboards​

Three new dashboards are available under Dashboards:

• TLS: TLS volume, legacy TLS/SSL use, negotiated versions, servers still negotiating SSLv2 to TLS 1.1, the most and least requested server names, certificate issuers and subjects, JA4 and JA3S fingerprints, and TLS on ports other than 443.
• HTTP: request volume and error responses, the most and least requested hosts, URLs, content types, the most and least common user agents, methods, status codes, referrers, hosts serving executables, and HTTP on ports other than 80. Methods, status codes, and referrers require extended HTTP logging in Suricata.
• SSH: session volume, SSH-1 use, the most and least common client and server software, HASSH fingerprints, top clients and servers, SSH on ports other than 22, and server protocol versions.

Like the other dashboards, every value links to a search for the matching events, and the sensor selector and search box narrow all panels at once.

The Alerts dashboard also gains MITRE ATT&CK tactic and technique, attack target, and rule severity tables, taken from rule metadata as provided by rulesets such as ET Open. They are hidden when no alerts carry the metadata.

Agent Presence​

Agents now keep a persistent control connection to the EveBox Server even when packet capture and file retrieval are not enabled. Every agent shipping events to an EveBox Server shows on Administration → Agents with its hostname, address, version, platform, connection time, and last-seen, and agents with a key show as online or offline.

Agents without a key are no longer refused. They are listed in a separate Unregistered Agents card for presence only: they get no packet capture or file retrieval and are never a routing source. Agents must run 0.31.0 or later to appear.

If the EveBox Server is behind a reverse proxy such as Traefik or nginx, enable reverse-proxy support so agent addresses, agent connection logs, and the packet capture and file download audit logs show the client's address instead of the proxy's:

http:
  reverse-proxy: true

The address is taken from the proxy's X-Real-Ip header, or else the last X-Forwarded-For entry.

Better Elasticsearch and OpenSearch Searches​

Searching a field for a value with spaces, capitals, or punctuation, such as tls.version:"TLS 1.2", found nothing for most fields on Elasticsearch and OpenSearch, and dashboard tables for those fields stayed empty. EveBox now reads the index field types to decide which fields to match exactly, instead of relying on a fixed list, and picks up new fields as new event types start arriving. Values are matched exactly, as they are with SQLite, and single lowercase words that matched before still do.

Searches that fail on some shards, which return partial or no results, are now logged as warnings for the inbox, dashboards, and counts, not just the events view. On wide indices, for example, free-text searches with several words can exceed OpenSearch's default limit of 1024 clauses.

Other Improvements​

• SQLite: searches on rule metadata, such as alert.metadata.attack_target:Client_Endpoint, now match.
• The admin pages are wider, and the agents table no longer has a row for the server's own packet capture spool and file store. (server) is still offered as a source in Source Routing.

Upgrade Notes​

The agent server.username and server.password options have been removed. Event submission never checked them; agent keys (server.key) are the agent credential. Agents log a warning if the old options are still set.

Installing​

Download EveBox 0.31.0 from the downloads page, or install with a single command.

Linux:

curl -sSf https://evebox.org/install.sh | sh

Windows PowerShell:

irm https://evebox.org/install.ps1 | iex

EveBox 0.30.0 has been released. This release adds previews and downloads of files extracted by Suricata, local packet extraction on Windows, and improvements to Elasticsearch, OpenSearch, and agent connections.

Preview and Download Extracted Files​

Files saved by Suricata's file-store output can now be inspected directly from the event view. File actions are available on fileinfo events and alerts with file information, with support for both a file store on the EveBox Server host and remote file stores served by EveBox Agents.

The preview offers file metadata and type detection, a hex view, decoded text, and extracted strings. It also warns when the file name, HTTP content type, or Suricata's file magic disagree with the detected content. Previews read at most the first 64 KiB, with a separate option to download the complete file.

Extracted files may be malicious. EveBox does not render them as HTML, images, or media, and previewing does not send file content to third-party services. Downloads are named by their SHA-256 digest rather than the file name seen on the network; handle them with care.

To enable the feature, use Suricata's file-store version 2 and point the EveBox Server or Agent at its directory with filestore.directory or --filestore-directory. Agents can serve files without packet capture, including on Windows. See the extracted files documentation for configuration and requirements.

Local Packet Extraction on Windows​

Windows builds now support local packet extraction when Npcap is installed. This includes packet downloads from server and agent PCAP spools, the evebox pcap extract command, and packet downloads from oneshot inputs.

Npcap is detected at runtime and is not required for other EveBox features. This removes the earlier Windows limitation that prevented local packet extraction, including downloads from a PCAP analyzed in oneshot mode.

Shared Source Routing​

The routing table under Administration → Agents is now named Source Routing. The same rules select the source for both packet capture downloads and extracted file previews and downloads, so sensors with remote file stores can use the existing routing configuration.

Connection Improvements​

Elasticsearch, OpenSearch, and agent connections now reuse HTTP clients and connection pools, reducing connection overhead and repeated certificate store warnings.

Plain HTTP connections to Elasticsearch, OpenSearch, and EveBox servers no longer load the system certificate store. This avoids startup failures and warnings when CA certificates are missing or unreadable. HTTPS certificate validation is unchanged.

Installing​

Download EveBox 0.30.0 from the downloads page, or install with a single command.

Linux:

curl -sSf https://evebox.org/install.sh | sh

Windows PowerShell:

irm https://evebox.org/install.ps1 | iex

The full packet capture quick start covered the typical agent/server deployment, with an EveBox Agent on each sensor. But if everything runs on one host, you don't need an agent at all. When the EveBox Server is already consuming Suricata's EVE log and the capture spool sits on the same host, full packet capture is one setting away: no agent, no keys.

Since 0.27, EveBox can download full packet captures (FPC) right from the web interface. Open an event and download the packets around it, or request a custom time range and BPF filter. EveBox extracts the packets on demand from a capture spool and returns them to your browser as a .pcap file.

This quick start covers the typical agent/server deployment, with an EveBox Agent on each sensor serving its local captures to a central EveBox Server. First we'll get a capture spool going. If a tool like Suricata or netsniff-ng is already writing capture files for you, jump ahead to Configuring EveBox.

This post has been updated for EveBox 0.29.0, where an agent's identity comes from its agent key and the old agent-id setting is no longer used.

EveBox 0.29.0 has been released. This is a smaller maintenance release focused on the event view, with richer event details, clickable rule references, and fixes for Suricata 8 events, plus more reliable SQLite backup and restore.

Richer Event Details​

The event view now has dedicated details panels for DNS, TLS, SSH, MQTT, QUIC, and mDNS events.

• DNS shows the query, record type, response code, and answers and authorities. This replaces the old DNS column, which did not understand the Suricata 8 DNS record format and could render "undefined" for the query.
• TLS shows SNI, version, ALPNs, certificate subject, issuer, serial, fingerprint and validity, along with JA4, JA3, and JA3S hashes.
• SSH shows client and server software versions and HASSH hashes.
• MQTT shows the message types in the transaction, with type-specific details such as client ID, topic, payload, and QoS.
• QUIC shows SNI, version, ALPN, JA4, JA3, and extension count.
• mDNS shows type, flags, queries, answers, and additionals, with per-record formatting for PTR, SRV, A/AAAA, and TXT.

Events without a dedicated panel now fall back to showing the scalar fields of the event object, so the details panel is never empty.

Clickable Rule References​

Rule references in the alert details of the event view are now links for known reference types such as url and cve. When Suricata 8 alert.references entries are present, the sensor's own resolution takes precedence.

SQLite Dump and Load Preserve Workflow State​

evebox sqlite dump now includes archived and escalated state as evebox.archived/evebox.escalated tags, along with the EveBox history, so workflow state survives a dump and restore into SQLite or Elasticsearch. evebox sqlite load now also restores escalated state.

Simpler Agent Identity​

Agent identity now comes from the agent authentication key: the key's name is stamped on submitted events (evebox.agent.id) and used on the packet capture control channel. The agent agent-id option and --agent-id flag are now ignored, so there is one less value to keep in sync between the sensor and the server.

Other Improvements​

• Boolean values in event details no longer render as empty cells.
• The experimental JA4 report and JA4db integration have been removed, as the upstream service is no longer available.
• Dependency updates.

Installing​

Download EveBox 0.29.0 from the downloads page, or install with a single command.

Linux:

curl -sSf https://evebox.org/install.sh | sh

Windows PowerShell:

irm https://evebox.org/install.ps1 | iex

EveBox 0.28.0 has been released. This release adds more flexible EVE input options, container-free PCAP analysis on all supported platforms, more capable auto-archive filters, and new dashboards.

New EVE Input Options​

The EveBox Server and Agent can now follow timestamped Suricata EVE spools named eve.json.<timestamp> or eve.json.<thread>.<timestamp>. Each threaded stream is processed independently, and processed spool files can optionally be deleted with input.delete-spool-files.

On Unix systems, EveBox can also receive EVE events directly from Suricata over Unix stream or datagram sockets, avoiding an intermediate EVE log file. See the EVE socket input documentation for configuration and durability considerations.

Analyze PCAPs Without a Container​

Oneshot PCAP mode can now run a locally installed Suricata (8.0.0 or newer) instead of containerized Suricata:

evebox oneshot --pcap capture.pcap

The local backend is selected with --suricata-backend local, or by pointing --suricata (and optionally --suricata-update) at the executables. Rules are updated with suricata-update when available, otherwise they are downloaded directly from the rule feeds, with downloads cached between runs. Suricata runs in a temporary workspace, leaving the installed Suricata configuration untouched. The generated configuration enables all protocol loggers, extended logging, and file hashing.

On Windows and macOS the local backend is the default, making oneshot PCAP analysis available on those platforms for the first time. On Linux, containers remain the default, and the local backend is used as a fallback when no usable container runtime is found. The local backend also reads captures in place, so the container backend's 4 GiB size limit does not apply.

On Windows, PCAP analysis and event import are supported, but packet extraction from the input PCAP is not available, and rules using the file.magic or filemagic keywords are removed, as the Windows Suricata builds do not support them.

Pipe EVE Events from Stdin​

Oneshot mode can now read EVE events from stdin by using - as the input:

curl https://example.com/eve.json | evebox oneshot -

Events are imported as they arrive rather than waiting for end of input.

New DNS and Anomalies Dashboards​

A new DNS dashboard joins the existing Overview, Alerts, and DHCP dashboards. Summary cards show query volume, NXDOMAIN and SERVFAIL rates, and the distinct DNS clients and servers seen, above DNS activity over time, the most and least requested names, top clients and servers, and top NXDOMAIN names and clients for spotting misconfigurations and suspicious lookups.

A new Anomalies dashboard surfaces Suricata protocol parser and decoder anomalies: low-volume, high-signal events that flag malformed traffic, evasion attempts, and broken clients, broken down by anomaly event, affected application protocol, type, layer, and top sources and destinations.

More Capable Auto-Archive Filters​

Auto-archive filters can now match exact DNS query names and TLS SNI values. Filtering happens after event enrichment and also applies to matching alerts indexed outside EveBox. Alert history records why an alert was automatically archived, and existing filters are migrated to the new condition format automatically.

Other Improvements​

• The Alerts dashboard adds summary cards for alert volume, counts by severity, and distinct signatures seen, plus alert categories and alerting protocols tables.
• The Overview dashboard adds summary cards for event volume, alert count and share, and the distinct event types and sensors seen.
• Administration pages now share a consistent layout and sidebar navigation between General, index management, Agents, and Filters.
• While events are still being imported, CTRL-C now stops the import, keeping the events read so far for review. A further CTRL-C exits.
• Rules that fail to load are now logged and skipped instead of aborting PCAP analysis.
• The oneshot database has moved to the EveBox cache directory, and stale databases from previous runs are cleaned up on startup. This also fixes a Windows issue where a new run could show the previous run's events.
• Empty bookmark files left by input startup checks are now ignored.
• SQLite full-text searches no longer match text found only in alert history.

Installing​

Download EveBox 0.28.0 from the downloads page, or install with a single command.

Linux:

curl -sSf https://evebox.org/install.sh | sh

Windows PowerShell:

irm https://evebox.org/install.ps1 | iex

EveBox 0.27.0 has been released. This release adds two major packet capture workflows: analyzing local captures in oneshot mode and retrieving full packet captures from capture spools.

Analyze PCAPs in Oneshot Mode​

On Linux, EveBox can now process one or more local PCAP or PCAPNG files:

evebox oneshot --pcap capture.pcap

EveBox uses a local Podman or Docker container to run Suricata, updates ET/Open, PawPatRules, and The Hunters Ledger rules, imports the generated EVE events, and opens them for review. Compact event-type count cards make it easy to see what Suricata found and filter the results.

The capture is processed locally and is not uploaded to a remote service. See Try EveBox for requirements and additional options.

Retrieve Full Packet Captures​

The EveBox web interface can now retrieve full packet captures for an event directly from a rotated capture spool, such as one written by Suricata's pcap-log output. Captures can also be requested for a custom time range and BPF filter.

The spool can be local to the EveBox Server or served by an EveBox Agent on a remote sensor. The new Administration → Agents page manages agent keys, connected capture sources, and routing rules that map event sensors to the correct source. This also lets an EveBox Server running on Windows retrieve captures through remote Linux agents.

New evebox pcap extract and evebox pcap purge commands provide direct command-line extraction and retention management for capture spools. See the packet capture documentation for setup details.

Other Highlights​

• Server database retention can now be disabled when older events need to remain available.
• The default browser time range can now be configured.
• Oneshot mode now opens the Events view and reports import failures instead of silently opening with partial or no data.
• Event descriptions include more useful details for several additional protocols.

Download EveBox 0.27.0 from the downloads page.

EveBox 0.26.0 has been released with new search filters, backend compatibility checks, update checking, and Elasticsearch/OpenSearch improvements.

Search and Help Improvements​

Alert searches can now filter by state directly from the search box:

• is:archived and -is:archived
• is:escalated and -is:escalated

These filters work with SQLite, Elasticsearch, and OpenSearch. The web UI Help dialog also has a new Search Queries tab with examples for common searches, shorthand fields, time filters, alert-state filters, and negation.

SQLite alert searches also gained support for @ip, @mac, @from, and @after, bringing alert search behavior closer to event search.

Backend and Update Checks​

A new evebox test elastic command, also available as evebox test opensearch, can load a sample of EVE events into a throwaway index and exercise the queries and mutations EveBox uses in normal operation. Use --existing to run read-only checks against an existing backend.

A companion evebox test sqlite command runs equivalent checks against a throwaway SQLite database.

This release also adds evebox check-update and a Check for updates button in the web UI About dialog. Update checks are always user initiated; EveBox does not contact the update server on its own.

Elasticsearch and OpenSearch​

On OpenSearch, stats events are now indexed into a separate {index}-stats-YYYY.MM.DD index instead of the main daily event index. This keeps large stats.* counter mappings out of the main event index. Existing stats remain visible and age out normally.

The admin index management page now groups indices by date, shows per-date document and size totals, and deletes whole days at a time for date-based indices.

EveBox now aborts startup on unsupported Elasticsearch/OpenSearch versions. Elasticsearch 7.10 or newer and OpenSearch 2.6.0 or newer are required. Elasticsearch versions older than 8.19.0 now show a warning.

Fixes and Maintenance​

• The event JSON view now renders valid JSON
• Deprecated OpenSearch inline script fields are no longer used for tag/history updates
• Rust dependencies and Suricata rule parsing support were updated

EveBox 0.25.0 has been released.

This release includes alert navigation fixes and a small refresh button loading state improvement.

Fixed​

• Preserved alert list state when returning from an alert detail page with browser history
• Avoided showing an empty inbox after navigating away from an alert detail page and then going back

Changed​

• Improved refresh button loading state handling

EveBox 0.24.0 has been released with improvements to event filtering, dashboard controls, and SQLite importing.

New and Improved​

• Added a sensor selector to the Events page
• Added support for importing xz-compressed EVE JSON files with the SQLite CLI importer
• Refined the Events page filter controls and layout
• Unified the Dashboard refresh control layout and button styling
• Made --config-directory a global CLI argument

SQLite Import Performance​

The SQLite importer now uses a faster tokenizer for printable payload fields. It extracts ASCII words directly, skips base64 and HTTP response body data where appropriate, and avoids regex overhead during ingest.

Fixes and Maintenance​

This release also lowers the log level for lines not ending with a newline, removes stray SQLite retention debug logging, updates Rust and webapp dependencies, and removes the older rusqlite SQLite importer implementation.