3 posts tagged with "EveBox"

The full packet capture quick start covered the typical agent/server deployment, with an EveBox Agent on each sensor. But if everything runs on one host, you don't need an agent at all. When the EveBox Server is already consuming Suricata's EVE log and the capture spool sits on the same host, full packet capture is one setting away: no agent, no keys.

Since 0.27, EveBox can download full packet captures (FPC) right from the web interface. Open an event and download the packets around it, or request a custom time range and BPF filter. EveBox extracts the packets on demand from a capture spool and returns them to your browser as a .pcap file.

This quick start covers the typical agent/server deployment, with an EveBox Agent on each sensor serving its local captures to a central EveBox Server. First we'll get a capture spool going. If a tool like Suricata or netsniff-ng is already writing capture files for you, jump ahead to Configuring EveBox.

Just a note that I will no longer being provided MacOS or Linux Arm32 binary builds. EveBox should still fine on these systems, however I don't have the equipment to test myself. Sorry for any inconvenience.