Nie możesz wybrać więcej, niż 25 tematów Tematy muszą się zaczynać od litery lub cyfry, mogą zawierać myślniki ('-') i mogą mieć do 35 znaków.
Jason Ish 527da5a6f9 github actions: push docker image to docker hub 1 miesiąc temu
.github/workflows github actions: push docker image to docker hub 1 miesiąc temu
agent gofmt 1 rok temu
appcontext gofmt 1 rok temu
cmd server: bind to localhost by default instead of 0.0.0.0 1 miesiąc temu
core gofmt 1 rok temu
data webapp: new flow graph 1 rok temu
deb deb: default to /etc/evebox/evebox.yaml 2 lat temu
doc esimport: use default index of logstash index of evebox 11 miesięcy temu
docker docker builder: use go 1.13 1 miesiąc temu
elasticsearch server: find-flow: fix finding flow 1 miesiąc temu
eve eve: fix unit tests 2 lat temu
evereader Make per minte eve file read stats debug. 1 miesiąc temu
exiter postgres: basic support (no reporting) 2 lat temu
geoip oneshot: percentage progress while loading 2 lat temu
httpclient breakout the httpclient into its own package 1 rok temu
log postgres: basic support (no reporting) 2 lat temu
pcap more go reorg into packages 3 lat temu
postgres code cleanups: consolidate duplicated code... 1 rok temu
resources elasticsearch: fixes for version 7 6 miesięcy temu
rpm deb,rpm: use /var/lib/evebox by default 2 lat temu
ruleparser Pull go-idsrules into tree as ruleparser. 4 miesięcy temu
rules Pull go-idsrules into tree as ruleparser. 4 miesięcy temu
server Log event query time at debug level. 1 miesiąc temu
sqlite sqlite: archive event time as debug message, not info 1 miesiąc temu
useragent useragent: parser useragent on all events 2 lat temu
util gofmt 1 rok temu
vagrant/freebsd FreeBSD vagrant image for testing FreeBSD builds. 2 lat temu
webapp webapp: per alert shortcut cleanup 1 miesiąc temu
.dockerignore build: use gitlab-ci to build all releases 1 rok temu
.gitignore cleanup docker images and docker.sh 1 rok temu
.gitlab-ci.yml gitlab-ci: attempt to simplify a bit 1 miesiąc temu
CHANGELOG.md webapp: fix sensor name display 1 miesiąc temu
Dockerfile docker: update go to 1.13 1 miesiąc temu
LICENSE.txt frontend: port to angular 2 3 lat temu
Makefile misc: don't install reflex in install-deps 1 miesiąc temu
README.md readme: fix some outdated info 1 miesiąc temu
agent.yaml.example annotate events with the rule 2 lat temu
dev.sh dev.sh: don't use sh -x 1 miesiąc temu
docker.sh docker: fix macos build 1 miesiąc temu
evebox.yaml.example es: dynamically determine doc type 1 rok temu
go.mod misc: don't install reflex in install-deps 1 miesiąc temu
go.sum misc: don't install reflex in install-deps 1 miesiąc temu
pgctl.sh pgctl.sh: dev tool for starting/stopping postgres 3 lat temu

README.md

EveBox Documentation Status Build Status

EveBox is a web based Suricata “eve” event viewer for Elastic Search.

EveBox

Features

  • A web based event viewer with an “Inbox” approach to alert management.
  • Event search.
  • An agent for sending Suricata events to the EveBox server (but you can use Filebeat/Logstash instead).
  • Embedded SQLite for self-contained installations.

Requirements

  • Suricata - to generate alerts and events.

And one of…

  • An existing ELK (version 5 or greater) setup already handling Suricata events.
  • Just Elastic Search as an event store.
  • Nothing - EveBox can use an embedded SQLite database suitable for lower load installations (note: not all features supported yet).
  • A modern web browser.

Installation.

Download a package and run the evebox application against your existing Elastic Search server.

Example:

./evebox server -e http://localhost:9200

Then visit http://localhost:5636 with your browser.

The latest release builds can be found at https://evebox.org/files/release/latest/.

The latest development builds (from git master) can be found at https://evebox.org/files/development/

A RPM and Debian package repository are also available.

SELKS

EveBox is also included in SELKS which provides Suricata and an ELK stack configured and ready to go.

Docker

If you wish to install EveBox with Docker an up to date image is hosted on Docker hub.

Example:

docker pull jasonish/evebox:latest
docker run -it -p 5636:5636 jasonish/evebox:latest -e http://elasticsearch:9200

replacing your http://elasticsearch:9200 with that of your Elastic Search URL. You most likely do not want to use localhost here as that will be the localhost of the container, not of the host.

OR if you want to link to an already running Elastic Search container:

docker run -it -p 5636:5636 --link elasticsearch jasonish/evebox:latest

Then visit http://localhost:5636 with your browser.

This should not require any modification to your Elastic Search configuration. Unlike previous versions of Evebox, you do not need to enable dynamic scripting and CORS.

Usage

EveBox runs as a server exposing a web interface on port 5636 by default.

With an Existing Elastic Search Server With Events

The basic mode where eve events are being sent to Elastic Search with Logstash and or Filebeat.

evebox server -e http://elasticsearch:9200

With the Embedded SQLite Database

This is useful if you don’t have Elastic Search and running EveBox on the same machine as Suricata. It uses an embedded SQLite database for events and is suitable for ligher loads. Currently SQLite does not support reporting.

evebox server --datastore sqlite --input /var/log/suricata/eve.json

More documentation can be found at http://evebox.readthedocs.io/en/latest/.

Building EveBox

EveBox consists of a JavaScript frontend, and a very minimal backend written in Go. To build Evebox the following requirements must first be satisfied:

  • Node.js v10.13.0 or newer installed.
  • Go 1.13.0 or new installed.

First checkout EveBox. As EveBox uses Go 1.11 modules, do not check it out into your GOPATH.

For example:

git clone https://github.com/jasonish/evebox.git ~/project/evebox

If this is the first build the npm and Go dependencies must be installed, this can be done with:

make install-deps
to re-run after git pulls.

Then to build the binary:

make


Or to build a release package:

make dist


If you don't want to bother with the required development tools, but do have
Docker installed, you can build a release with the following command:

./docker.sh release


## Run in Development Mode

./dev.sh -e http://elasticsearch:9200 ```

to run in development mode using an Elastic Search datastore at http://elasticsearch:9200.

The connect your browser to http://localhost:4200. Note this port is different than the EveBox port, as the Angular CLI/Webpack development server is used to serve up the web application with backend requests being proxied to the Go application.

In development mode changes to Go files will trigger a recompile/restart, and changes to the web app will trigger a recompile of the javascript and a browser refresh.

A Note on Authentication

While the latest development versions of EveBox support authentication, TLS support is not included. Therefore it is advised to run EveBox behind a reverse proxy that terminals TLS/SSL.

Change Log

See https://github.com/jasonish/evebox/blob/master/CHANGELOG.md .

License

BSD.