Skip to main content

EveBox 0.31.0 Released

· 4 min read

EveBox 0.31.0 has been released. This release shows the related events of a flow in the event view, adds TLS, HTTP, and SSH dashboards, makes agents visible on the Agents page whether or not they serve packet captures or files, and makes field searches on Elasticsearch and OpenSearch much more reliable.

The event view has a new Flow card listing the other events Suricata logged for the same flow: app-layer records such as TLS, HTTP, and DNS, file information, and the flow record. A summary line shows the flow's duration, packets and bytes in each direction, application protocol, state, and end reason, and each event's offset from the start of the flow.

A single flow can raise the same alert thousands of times, so alerts are grouped by signature with their count and time span, and runs of identical events are collapsed. Each count links to a search for the grouped events. The card is hidden when an event is the only one in its flow. The same data is available from the API as GET /api/event/{id}/flow.

TLS, HTTP, and SSH Dashboards​

Three new dashboards are available under Dashboards:

  • TLS: TLS volume, legacy TLS/SSL use, negotiated versions, servers still negotiating SSLv2 to TLS 1.1, the most and least requested server names, certificate issuers and subjects, JA4 and JA3S fingerprints, and TLS on ports other than 443.
  • HTTP: request volume and error responses, the most and least requested hosts, URLs, content types, the most and least common user agents, methods, status codes, referrers, hosts serving executables, and HTTP on ports other than 80. Methods, status codes, and referrers require extended HTTP logging in Suricata.
  • SSH: session volume, SSH-1 use, the most and least common client and server software, HASSH fingerprints, top clients and servers, SSH on ports other than 22, and server protocol versions.

Like the other dashboards, every value links to a search for the matching events, and the sensor selector and search box narrow all panels at once.

The Alerts dashboard also gains MITRE ATT&CK tactic and technique, attack target, and rule severity tables, taken from rule metadata as provided by rulesets such as ET Open. They are hidden when no alerts carry the metadata.

Agent Presence​

Agents now keep a persistent control connection to the EveBox Server even when packet capture and file retrieval are not enabled. Every agent shipping events to an EveBox Server shows on Administration → Agents with its hostname, address, version, platform, connection time, and last-seen, and agents with a key show as online or offline.

Agents without a key are no longer refused. They are listed in a separate Unregistered Agents card for presence only: they get no packet capture or file retrieval and are never a routing source. Agents must run 0.31.0 or later to appear.

If the EveBox Server is behind a reverse proxy such as Traefik or nginx, enable reverse-proxy support so agent addresses, agent connection logs, and the packet capture and file download audit logs show the client's address instead of the proxy's:

http:
  reverse-proxy: true

The address is taken from the proxy's X-Real-Ip header, or else the last X-Forwarded-For entry.

Better Elasticsearch and OpenSearch Searches​

Searching a field for a value with spaces, capitals, or punctuation, such as tls.version:"TLS 1.2", found nothing for most fields on Elasticsearch and OpenSearch, and dashboard tables for those fields stayed empty. EveBox now reads the index field types to decide which fields to match exactly, instead of relying on a fixed list, and picks up new fields as new event types start arriving. Values are matched exactly, as they are with SQLite, and single lowercase words that matched before still do.

Searches that fail on some shards, which return partial or no results, are now logged as warnings for the inbox, dashboards, and counts, not just the events view. On wide indices, for example, free-text searches with several words can exceed OpenSearch's default limit of 1024 clauses.

Other Improvements​

  • SQLite: searches on rule metadata, such as alert.metadata.attack_target:Client_Endpoint, now match.
  • The admin pages are wider, and the agents table no longer has a row for the server's own packet capture spool and file store. (server) is still offered as a source in Source Routing.

Upgrade Notes​

The agent server.username and server.password options have been removed. Event submission never checked them; agent keys (server.key) are the agent credential. Agents log a warning if the old options are still set.

Installing​

Download EveBox 0.31.0 from the downloads page, or install with a single command.

Linux:

curl -sSf https://evebox.org/install.sh | sh

Windows PowerShell:

irm https://evebox.org/install.ps1 | iex
💬 Discuss this post · Have a question? Ask here