Skip to main content

EveBox 0.27.0 Released

· 2 min read

EveBox 0.27.0 has been released. This release adds two major packet capture workflows: analyzing local captures in oneshot mode and retrieving full packet captures from capture spools.

Analyze PCAPs in Oneshot Mode​

On Linux, EveBox can now process one or more local PCAP or PCAPNG files:

evebox oneshot --pcap capture.pcap

EveBox uses a local Podman or Docker container to run Suricata, updates ET/Open, PawPatRules, and The Hunters Ledger rules, imports the generated EVE events, and opens them for review. Compact event-type count cards make it easy to see what Suricata found and filter the results.

The capture is processed locally and is not uploaded to a remote service. See Try EveBox for requirements and additional options.

Retrieve Full Packet Captures​

The EveBox web interface can now retrieve full packet captures for an event directly from a rotated capture spool, such as one written by Suricata's pcap-log output. Captures can also be requested for a custom time range and BPF filter.

The spool can be local to the EveBox Server or served by an EveBox Agent on a remote sensor. The new Administration → Agents page manages agent keys, connected capture sources, and routing rules that map event sensors to the correct source. This also lets an EveBox Server running on Windows retrieve captures through remote Linux agents.

New evebox pcap extract and evebox pcap purge commands provide direct command-line extraction and retention management for capture spools. See the packet capture documentation for setup details.

Other Highlights​

  • Server database retention can now be disabled when older events need to remain available.
  • The default browser time range can now be configured.
  • Oneshot mode now opens the Events view and reports import failures instead of silently opening with partial or no data.
  • Event descriptions include more useful details for several additional protocols.

Download EveBox 0.27.0 from the downloads page.