EveBox 0.30.0 Released

EveBox 0.30.0 has been released. This release adds previews and downloads of files extracted by Suricata, local packet extraction on Windows, and improvements to Elasticsearch, OpenSearch, and agent connections.

Preview and Download Extracted Files

Files saved by Suricata's file-store output can now be inspected directly from the event view. File actions are available on fileinfo events and alerts with file information, with support for both a file store on the EveBox Server host and remote file stores served by EveBox Agents.

The preview offers file metadata and type detection, a hex view, decoded text, and extracted strings. It also warns when the file name, HTTP content type, or Suricata's file magic disagree with the detected content. Previews read at most the first 64 KiB, with a separate option to download the complete file.

Extracted files may be malicious. EveBox does not render them as HTML, images, or media, and previewing does not send file content to third-party services. Downloads are named by their SHA-256 digest rather than the file name seen on the network; handle them with care.

To enable the feature, use Suricata's file-store version 2 and point the EveBox Server or Agent at its directory with filestore.directory or --filestore-directory. Agents can serve files without packet capture, including on Windows. See the extracted files documentation for configuration and requirements.

Local Packet Extraction on Windows

Windows builds now support local packet extraction when Npcap is installed. This includes packet downloads from server and agent PCAP spools, the evebox pcap extract command, and packet downloads from oneshot inputs.

Npcap is detected at runtime and is not required for other EveBox features. This removes the earlier Windows limitation that prevented local packet extraction, including downloads from a PCAP analyzed in oneshot mode.

Shared Source Routing

The routing table under Administration → Agents is now named Source Routing. The same rules select the source for both packet capture downloads and extracted file previews and downloads, so sensors with remote file stores can use the existing routing configuration.

Connection Improvements

Elasticsearch, OpenSearch, and agent connections now reuse HTTP clients and connection pools, reducing connection overhead and repeated certificate store warnings.

Plain HTTP connections to Elasticsearch, OpenSearch, and EveBox servers no longer load the system certificate store. This avoids startup failures and warnings when CA certificates are missing or unreadable. HTTPS certificate validation is unchanged.

Installing

Download EveBox 0.30.0 from the downloads page, or install with a single command.

Linux:

curl -sSf https://evebox.org/install.sh | sh

Windows PowerShell:

irm https://evebox.org/install.ps1 | iex