EveBox 0.28.0 Released

EveBox 0.28.0 has been released. This release adds more flexible EVE input options, container-free PCAP analysis on all supported platforms, more capable auto-archive filters, and new dashboards.

New EVE Input Options

The EveBox Server and Agent can now follow timestamped Suricata EVE spools named eve.json.<timestamp> or eve.json.<thread>.<timestamp>. Each threaded stream is processed independently, and processed spool files can optionally be deleted with input.delete-spool-files.

On Unix systems, EveBox can also receive EVE events directly from Suricata over Unix stream or datagram sockets, avoiding an intermediate EVE log file. See the EVE socket input documentation for configuration and durability considerations.

Analyze PCAPs Without a Container

Oneshot PCAP mode can now run a locally installed Suricata (8.0.0 or newer) instead of containerized Suricata:

evebox oneshot --pcap capture.pcap

The local backend is selected with --suricata-backend local, or by pointing --suricata (and optionally --suricata-update) at the executables. Rules are updated with suricata-update when available, otherwise they are downloaded directly from the rule feeds, with downloads cached between runs. Suricata runs in a temporary workspace, leaving the installed Suricata configuration untouched. The generated configuration enables all protocol loggers, extended logging, and file hashing.

On Windows and macOS the local backend is the default, making oneshot PCAP analysis available on those platforms for the first time. On Linux, containers remain the default, and the local backend is used as a fallback when no usable container runtime is found. The local backend also reads captures in place, so the container backend's 4 GiB size limit does not apply.

On Windows, PCAP analysis and event import are supported, but packet extraction from the input PCAP is not available, and rules using the file.magic or filemagic keywords are removed, as the Windows Suricata builds do not support them.

Pipe EVE Events from Stdin

Oneshot mode can now read EVE events from stdin by using - as the input:

curl https://example.com/eve.json | evebox oneshot -

Events are imported as they arrive rather than waiting for end of input.

New DNS and Anomalies Dashboards

A new DNS dashboard joins the existing Overview, Alerts, and DHCP dashboards. Summary cards show query volume, NXDOMAIN and SERVFAIL rates, and the distinct DNS clients and servers seen, above DNS activity over time, the most and least requested names, top clients and servers, and top NXDOMAIN names and clients for spotting misconfigurations and suspicious lookups.

A new Anomalies dashboard surfaces Suricata protocol parser and decoder anomalies: low-volume, high-signal events that flag malformed traffic, evasion attempts, and broken clients, broken down by anomaly event, affected application protocol, type, layer, and top sources and destinations.

More Capable Auto-Archive Filters

Auto-archive filters can now match exact DNS query names and TLS SNI values. Filtering happens after event enrichment and also applies to matching alerts indexed outside EveBox. Alert history records why an alert was automatically archived, and existing filters are migrated to the new condition format automatically.

Other Improvements

• The Alerts dashboard adds summary cards for alert volume, counts by severity, and distinct signatures seen, plus alert categories and alerting protocols tables.
• The Overview dashboard adds summary cards for event volume, alert count and share, and the distinct event types and sensors seen.
• Administration pages now share a consistent layout and sidebar navigation between General, index management, Agents, and Filters.
• While events are still being imported, CTRL-C now stops the import, keeping the events read so far for review. A further CTRL-C exits.
• Rules that fail to load are now logged and skipped instead of aborting PCAP analysis.
• The oneshot database has moved to the EveBox cache directory, and stale databases from previous runs are cleaned up on startup. This also fixes a Windows issue where a new run could show the previous run's events.
• Empty bookmark files left by input startup checks are now ignored.
• SQLite full-text searches no longer match text found only in alert history.

Installing

Download EveBox 0.28.0 from the downloads page, or install with a single command.

Linux:

curl -sSf https://evebox.org/install.sh | sh

Windows PowerShell:

irm https://evebox.org/install.ps1 | iex