Triage like an inbox
Archive, escalate, and comment for the next analyst. Auto-archive recurring alerts by SID, optionally matching a sensor, address pair, exact DNS name, or TLS SNI. Alert history shows why each automatic archive happened.
Tools for the people behind the detections
Your Suricata.
In focus.
Understand the rules going into Suricata. Investigate the events coming out. Browse detection changes with EveBox Rules, then triage alerts and follow the packet evidence with self-hosted EveBox.
EveBox: self-hosted · EveBox Rules: free hosted · no signup to browse
01EveBox
Self-hosted · MIT licensed · EveBox 0.28
See what fired
EveBox: Less noise. More understanding.
Make sense of Suricata's EVE JSON. Clear recurring alert noise, search stored events, explore DNS and protocol anomalies, and retrieve the packets behind a detection. New alerts arrive live in your browser.
The EveBox inbox. Real events, severity at a glance, and a clear triage workflow.
See beyond the alert
Explore DNS query volume, failed lookups, and top clients. The Anomalies dashboard breaks down Suricata parser and decoder events by protocol, type, and affected hosts. Filter by sensor and time range.
Review a PCAP in one command
Run evebox oneshot --pcap to process local captures and open the event viewer. Use Podman or Docker on Linux, or a locally installed Suricata on Linux and Windows. Windows supports analysis and import; packet extraction requires Linux.
Packet capture on demand
Configure a local server or remote EveBox Agent capture spool, then download packets matching an event flow, a time window, or a custom BPF filter. Route requests to the capture source for each sensor.
Start small or scale out
Run the embedded SQLite store for a self-contained installation, or connect to Elasticsearch or OpenSearch for a larger deployment. Keep your existing Filebeat or Logstash pipeline when it already supplies your events.
One binary, flexible ingest
The server and web UI ship together. Read EVE JSON files and timestamped Suricata spools, or send events with the EveBox Agent. On Unix, configured stream or datagram sockets accept EVE output without an intermediate log file.
02EveBox Rules
Free hosted service · no account required to browse
Control what fires
EveBox Rules: Know the rule. Understand the change.
Know what changed before updating your detections. Search Suricata rules, browse their source files, and compare full before/after rule text. Observed history stays accessible even after a rule is removed.
example/ruleset SID 9000001 rev 1 → 2 modified
example.rules
Before
alert http $HOME_NET any -> $EXTERNAL_NET any ( msg:"EXAMPLE Suspicious HTTP Request"; content:"/old-path"; http_uri; sid:9000001; rev:1;)After
alert http $HOME_NET any -> $EXTERNAL_NET any ( msg:"EXAMPLE Suspicious HTTP Request"; content:"/new-path"; http_uri; reference:cve,2099-0001; sid:9000001; rev:2;) this update: added 8 modified 3 removed 1 disabled 2
An illustrative ruleset update, with complete before and after rule text.
Per-update changelogs
Open a ruleset update to see added, modified, removed, enabled, disabled, and moved rules, with generated or feed-derived changes summarized separately.
Before and after, in full
Expand a modified entry to compare complete before/after rule text, revision changes, filename moves, and links to the rule detail and version history.
History that survives removal
Each observed rule version is kept as current, superseded, or removed. Removed rules retain working detail and history pages when you're investigating an older alert.
Search across many sources
Emerging Threats, abuse.ch, PawPatRules and more from one place. Search by SID, message and CVE, with per-rule detail pages, a sources catalog, and CVE browsing. Press / to jump to search.
Browse rules as files
Open a ruleset by original filename, page through its rules, and expand parsed details in place. Signed-in operators can switch to a reconstructed file view, and multi-feed sources expose each variant.
Personal lists and private access
Star rules for a personal working set; sign in with GitHub to keep them with your account. Access grants expose private rulesets only to the accounts they are shared with.
The workflow
From detection to decision.
Suricata inspects your traffic and produces EVE JSON. EveBox Rules helps you understand its detections; EveBox helps you investigate their results.
- 01
EveBox Rules
Control what fires
Search rules, read their history, and review what changed before you update your detections.
- 02
the engine
Suricata detects
Suricata inspects traffic with your rules and emits EVE JSON events and alerts. It is a separate open-source project.
- 03
EveBox
See what fired
Triage the inbox, search events, and retrieve available packet evidence. Keep a record for the next analyst.
- 04
back to Rules
Close the loop
Return to the rule behind an alert. Use that context in your next ruleset decision, then finish triage.
Make it part of your workflow
Start with the side you need.
Run EveBox beside your events. Open EveBox Rules in your browser.
Run EveBox
Self-hosted alert manager — point it at your events and open :5636.
Quick start · embedded SQLite
evebox server --datastore sqlite \
--input /var/log/suricata/eve.jsonMore ways to run EveBox
PCAP review · Linux containers or local Suricata
evebox oneshot --pcap capture.pcapPCAP review · installed Suricata on Linux / Windows
evebox oneshot --suricata-backend local --pcap capture.pcapDocker · with existing Elasticsearch
docker run -it -p 5636:5636 \
jasonish/evebox:latest \
-e http://elasticsearch:9200- RPM / Deb package repositories
- Standalone binary download
- EveCtl — menu-driven Suricata + EveBox + Elasticsearch
- Bundled in ClearNDR Community Edition
Open EveBox Rules
Nothing to install — it's a free, hosted web service.
- Browse and search rules instantly, no account needed
- Review each indexed update with full before/after rule text
- Browse rulesets by original source file and feed variant
- Sign in with GitHub to keep a personal list of starred rules
- Press / anywhere to jump straight to search
FAQ
A few things
worth knowing.
Can I investigate a PCAP without a running sensor?
Yes. Run evebox oneshot --pcap capture.pcap. On Linux, EveBox can run Suricata through Podman or Docker, or use a local installation. Windows uses a locally installed Suricata. EveBox imports the generated events and opens the viewer. Windows does not support extracting packets from the input capture.
Are EveBox and EveBox Rules the same product?
They're one suite, deliberately built as two focused tools. EveBox (at evebox.org) is the alert and event manager you self-host. EveBox Rules (at rules.evebox.org) is the free hosted rule platform. Same author and operating story — different products and deployment models.
Is it free?
Yes. EveBox is open source under the MIT license and free to self-host. The EveBox Rules web app is AGPL v3 and runs as a free public hosted service — open it and go.
Do I need Elasticsearch to run EveBox?
No. EveBox includes an embedded SQLite datastore for self-contained, lighter-load installations. For larger deployments, it supports Elasticsearch 7.10 or newer and OpenSearch 2.6 or newer.
Where do I download EveBox?
From evebox.org: a Docker image (jasonish/evebox), RPM/Deb repositories, raw binaries, or the menu-driven EveCtl. It's also bundled in ClearNDR Community Edition (formerly SELKS).
What is Suricata?
Suricata is the open-source IDS/IPS/NSM engine that inspects network traffic against detection rules and emits EVE JSON events and alerts. EveBox doesn't replace Suricata — it's the suite for operating the rules it runs and the alerts it produces.