EveBox 0.28.0 has been released. This release adds more flexible EVE input options, container-free PCAP analysis on all supported platforms, more capable auto-archive filters, and new dashboards.

New EVE Input Options​

The EveBox Server and Agent can now follow timestamped Suricata EVE spools named eve.json.<timestamp> or eve.json.<thread>.<timestamp>. Each threaded stream is processed independently, and processed spool files can optionally be deleted with input.delete-spool-files.

On Unix systems, EveBox can also receive EVE events directly from Suricata over Unix stream or datagram sockets, avoiding an intermediate EVE log file. See the EVE socket input documentation for configuration and durability considerations.

Analyze PCAPs Without a Container​

Oneshot PCAP mode can now run a locally installed Suricata (8.0.0 or newer) instead of containerized Suricata:

evebox oneshot --pcap capture.pcap

The local backend is selected with --suricata-backend local, or by pointing --suricata (and optionally --suricata-update) at the executables. Rules are updated with suricata-update when available, otherwise they are downloaded directly from the rule feeds, with downloads cached between runs. Suricata runs in a temporary workspace, leaving the installed Suricata configuration untouched. The generated configuration enables all protocol loggers, extended logging, and file hashing.

On Windows and macOS the local backend is the default, making oneshot PCAP analysis available on those platforms for the first time. On Linux, containers remain the default, and the local backend is used as a fallback when no usable container runtime is found. The local backend also reads captures in place, so the container backend's 4 GiB size limit does not apply.

On Windows, PCAP analysis and event import are supported, but packet extraction from the input PCAP is not available, and rules using the file.magic or filemagic keywords are removed, as the Windows Suricata builds do not support them.

Pipe EVE Events from Stdin​

Oneshot mode can now read EVE events from stdin by using - as the input:

curl https://example.com/eve.json | evebox oneshot -

Events are imported as they arrive rather than waiting for end of input.

New DNS and Anomalies Dashboards​

A new DNS dashboard joins the existing Overview, Alerts, and DHCP dashboards. Summary cards show query volume, NXDOMAIN and SERVFAIL rates, and the distinct DNS clients and servers seen, above DNS activity over time, the most and least requested names, top clients and servers, and top NXDOMAIN names and clients for spotting misconfigurations and suspicious lookups.

A new Anomalies dashboard surfaces Suricata protocol parser and decoder anomalies: low-volume, high-signal events that flag malformed traffic, evasion attempts, and broken clients, broken down by anomaly event, affected application protocol, type, layer, and top sources and destinations.

More Capable Auto-Archive Filters​

Auto-archive filters can now match exact DNS query names and TLS SNI values. Filtering happens after event enrichment and also applies to matching alerts indexed outside EveBox. Alert history records why an alert was automatically archived, and existing filters are migrated to the new condition format automatically.

Other Improvements​

• The Alerts dashboard adds summary cards for alert volume, counts by severity, and distinct signatures seen, plus alert categories and alerting protocols tables.
• The Overview dashboard adds summary cards for event volume, alert count and share, and the distinct event types and sensors seen.
• Administration pages now share a consistent layout and sidebar navigation between General, index management, Agents, and Filters.
• While events are still being imported, CTRL-C now stops the import, keeping the events read so far for review. A further CTRL-C exits.
• Rules that fail to load are now logged and skipped instead of aborting PCAP analysis.
• The oneshot database has moved to the EveBox cache directory, and stale databases from previous runs are cleaned up on startup. This also fixes a Windows issue where a new run could show the previous run's events.
• Empty bookmark files left by input startup checks are now ignored.
• SQLite full-text searches no longer match text found only in alert history.

Installing​

Download EveBox 0.28.0 from the downloads page, or install with a single command.

Linux:

curl -sSf https://evebox.org/install.sh | sh

Windows PowerShell:

irm https://evebox.org/install.ps1 | iex

The full packet capture quick start covered the typical agent/server deployment, with an EveBox Agent on each sensor. But if everything runs on one host, you don't need an agent at all. When the EveBox Server is already consuming Suricata's EVE log and the capture spool sits on the same host, full packet capture is one setting away: no agent, no keys.

Since 0.27, EveBox can download full packet captures (FPC) right from the web interface. Open an event and download the packets around it, or request a custom time range and BPF filter. EveBox extracts the packets on demand from a capture spool and returns them to your browser as a .pcap file.

This quick start covers the typical agent/server deployment, with an EveBox Agent on each sensor serving its local captures to a central EveBox Server. First we'll get a capture spool going. If a tool like Suricata or netsniff-ng is already writing capture files for you, jump ahead to Configuring EveBox.

EveBox 0.27.0 has been released. This release adds two major packet capture workflows: analyzing local captures in oneshot mode and retrieving full packet captures from capture spools.

Analyze PCAPs in Oneshot Mode​

On Linux, EveBox can now process one or more local PCAP or PCAPNG files:

evebox oneshot --pcap capture.pcap

EveBox uses a local Podman or Docker container to run Suricata, updates ET/Open, PawPatRules, and The Hunters Ledger rules, imports the generated EVE events, and opens them for review. Compact event-type count cards make it easy to see what Suricata found and filter the results.

The capture is processed locally and is not uploaded to a remote service. See Try EveBox for requirements and additional options.

Retrieve Full Packet Captures​

The EveBox web interface can now retrieve full packet captures for an event directly from a rotated capture spool, such as one written by Suricata's pcap-log output. Captures can also be requested for a custom time range and BPF filter.

The spool can be local to the EveBox Server or served by an EveBox Agent on a remote sensor. The new Administration → Agents page manages agent keys, connected capture sources, and routing rules that map event sensors to the correct source. This also lets an EveBox Server running on Windows retrieve captures through remote Linux agents.

New evebox pcap extract and evebox pcap purge commands provide direct command-line extraction and retention management for capture spools. See the packet capture documentation for setup details.

Other Highlights​

• Server database retention can now be disabled when older events need to remain available.
• The default browser time range can now be configured.
• Oneshot mode now opens the Events view and reports import failures instead of silently opening with partial or no data.
• Event descriptions include more useful details for several additional protocols.

Download EveBox 0.27.0 from the downloads page.

EveBox 0.26.0 has been released with new search filters, backend compatibility checks, update checking, and Elasticsearch/OpenSearch improvements.

Search and Help Improvements​

Alert searches can now filter by state directly from the search box:

• is:archived and -is:archived
• is:escalated and -is:escalated

These filters work with SQLite, Elasticsearch, and OpenSearch. The web UI Help dialog also has a new Search Queries tab with examples for common searches, shorthand fields, time filters, alert-state filters, and negation.

SQLite alert searches also gained support for @ip, @mac, @from, and @after, bringing alert search behavior closer to event search.

Backend and Update Checks​

A new evebox test elastic command, also available as evebox test opensearch, can load a sample of EVE events into a throwaway index and exercise the queries and mutations EveBox uses in normal operation. Use --existing to run read-only checks against an existing backend.

A companion evebox test sqlite command runs equivalent checks against a throwaway SQLite database.

This release also adds evebox check-update and a Check for updates button in the web UI About dialog. Update checks are always user initiated; EveBox does not contact the update server on its own.

Elasticsearch and OpenSearch​

On OpenSearch, stats events are now indexed into a separate {index}-stats-YYYY.MM.DD index instead of the main daily event index. This keeps large stats.* counter mappings out of the main event index. Existing stats remain visible and age out normally.

The admin index management page now groups indices by date, shows per-date document and size totals, and deletes whole days at a time for date-based indices.

EveBox now aborts startup on unsupported Elasticsearch/OpenSearch versions. Elasticsearch 7.10 or newer and OpenSearch 2.6.0 or newer are required. Elasticsearch versions older than 8.19.0 now show a warning.

Fixes and Maintenance​

• The event JSON view now renders valid JSON
• Deprecated OpenSearch inline script fields are no longer used for tag/history updates
• Rust dependencies and Suricata rule parsing support were updated

EveBox 0.25.0 has been released.

This release includes alert navigation fixes and a small refresh button loading state improvement.

Fixed​

• Preserved alert list state when returning from an alert detail page with browser history
• Avoided showing an empty inbox after navigating away from an alert detail page and then going back

Changed​

• Improved refresh button loading state handling

EveBox 0.24.0 has been released with improvements to event filtering, dashboard controls, and SQLite importing.

New and Improved​

• Added a sensor selector to the Events page
• Added support for importing xz-compressed EVE JSON files with the SQLite CLI importer
• Refined the Events page filter controls and layout
• Unified the Dashboard refresh control layout and button styling
• Made --config-directory a global CLI argument

SQLite Import Performance​

The SQLite importer now uses a faster tokenizer for printable payload fields. It extracts ASCII words directly, skips base64 and HTTP response body data where appropriate, and avoids regex overhead during ingest.

Fixes and Maintenance​

This release also lowers the log level for lines not ending with a newline, removes stray SQLite retention debug logging, updates Rust and webapp dependencies, and removes the older rusqlite SQLite importer implementation.

EveBox 0.23.0 has been released.

This is a maintenance release that updates dependencies and keeps the release packages current. There are no major user-facing feature changes in this release.

EveBox 0.22.0 has been released. This release focuses on the stats Dashboard, improving both historical navigation and chart usability.

Stats Dashboard​

The stats Dashboard now supports time ranges, making it easier to review historical Suricata stats instead of only looking at the most recent window.

Highlights include:

• Date navigation for browsing historical time windows
• A visible selected time range in the UI
• Multi-sensor support with per-sensor line graphs
• Additional charts for flow active, flow total, flow spare, and TCP reassembly memory
• Synchronized chart crosshairs for easier comparison across graphs

Performance​

HTTP requests made by the server and agent now use the Hickory DNS resolver. This avoids repeated system resolver lookups, adds internal DNS caching, and can help agents sending larger batches of events.

SQLite sensor queries were also optimized to reduce unnecessary work.

Other Changes​

This release also improves chart color consistency, simplifies the stats API, updates EveBox to Rust edition 2024, and raises the Rust MSRV to 1.85.0.

I'm pleased to announce the release of EveBox 0.21.0, featuring API improvements, performance optimizations, and important fixes.

Key Changes​

API Simplification

• Streamlined API routes by removing version prefix (/api/1/* → /api/*)
• Legacy /api/1/submit endpoint preserved for backward compatibility

Agent Improvements

• Default data directory changed to /var/lib/evebox for systemd service
• Prevents bookmark files from being created in root directory

Performance

• Optimized server processor efficiency by replacing sleep(0) with yield_now()
• Improved CPU utilization and reduced unnecessary spinning

Fixes

• Fixed Debian package installation by ensuring /var/lib/evebox directory creation
• Resolves issues when using EVEBOX_DATA_DIRECTORY=/var/lib/evebox

Technical Updates

• Updated to latest Axum web framework
• Rust MSRV updated to 1.82.0
• Updated dependencies including nom parser v8 and maxminddb