EveBox 0.20.5 has been released with improved support for Suricata mDNS events.

Added​

• Added mDNS cards to the Address dashboard
• Added mDNS to the Events page event-type selector
• Added formatting for mDNS event descriptions

EveBox 0.20.4 has been released with dashboard improvements, a new packet capture utility, and Elasticsearch fixes.

New and Improved​

• Added top source and destination IP cards to the Overview dashboard
• Added the eve2pcap command-line utility
• Added clearer prefixes to badges in the Alerts view
• Updated dashboard components to use Bootstrap directly

Fixed​

• Increased the Elasticsearch sensor aggregation limit from 10 to 1000 (issue #335)
• Fixed aggregation values by consistently converting them to strings
• Truncated long sensor names where needed on the DHCP dashboard

EveBox 0.20.3 has been released with new retention controls for Elasticsearch and SQLite, along with several web interface fixes.

Elasticsearch Index Management​

Administrators can now view and manually delete Elasticsearch indices from the web interface. EveBox can also automatically delete dated indices older than a configured number of days.

This adds the date-based retention policy requested in issue #258.

SQLite Retention​

SQLite age- and size-based retention settings are now available from the Admin page, making it possible to manage database growth without editing the configuration file.

Fixed​

• Allowed periods in event comments without interfering with the comment form
• Preserved a query timeout value of zero in local storage
• Fixed disabling query timeouts by setting the value to zero

EveBox 0.20.2 has been released with two event display fixes.

Fixed​

• Removed the JA4db user-agent value from event descriptions because it could be incorrect
• Prevented non-alert events from receiving an unnecessary alert object while checking EveBox action metadata

EveBox 0.20.1 has been released.

This maintenance release fixes authentication on non-HTTPS connections, which was broken in EveBox 0.20.0. See issue #326 for details.

I've just released EveBox 0.20.0. Along with bug fixes, this release brings some new features I've wanted to add for some time:

Auto Archive by Age​

You can now set an age in days to auto-archive alerts. By default this feature is disabled, so you will need to enable it in the Admin settings.

Auto Archive by Filter​

From an alert, you can now choose to have future occurrences of that alert auto-archived.

Currently supported filters include:

• SID
• SID + Sensor
• SID + Source IP + Destination IP
• SID + Source IP + Destination IP + Sensor

I hope to provide a more flexible filtering solution along the lines of email filtering in the near future.

Kibana Inspired Filters​

In an alert view, hover over the signature or an IP address and you will see a + or - to filter for, or filter out alerts. This is a work in progress and will be brought to more pages and dashboards over time.

SQLite Responsiveness Enhancements​

SQLite results can be slow when the dataset is large. To address this a timeout has been added to the Inbox so results will be returned in a timely manner. By default this is 5 seconds.

Also, in the Dashboard aggregations, data will be streamed as its available. So you should see data in the tables right away, and results will be added as they are available.

Just a note that I will no longer being provided MacOS or Linux Arm32 binary builds. EveBox should still fine on these systems, however I don't have the equipment to test myself. Sorry for any inconvenience.