Control what fires.
See what fired.
Two purpose-built tools sit on either side of Suricata: hosted EveBox Rules helps you understand the rules that drive detection, and self-hosted EveBox turns the EVE JSON they produce into an alert and investigation workflow.
EveBox: self-hosted · EveBox Rules: free hosted · no signup to browse
Suricata is the open-source IDS/IPS/NSM engine that inspects your traffic with detection rules and writes EVE JSON alerts. EveBox is the suite for operating it — upstream and down.
The loop
Two halves of running Suricata — rules in, alerts out, and back again
- 01
Control what fires
EveBox Rules
Compare the rulesets you deploy across Emerging Threats, abuse.ch, PawPatRules and more. Search by SID, message or CVE, inspect rules by source file, and review each update — so detection choices rest on evidence.
- 02
Suricata detects
the engine
Suricata runs those rules against live traffic and emits EVE JSON events and alerts. It's the open-source engine the suite wraps — not an EveBox product.
- 03
See what fired
EveBox
The EVE stream lands in the EveBox inbox. Triage alerts like email — archive the noise, star and escalate the real threats, comment for your team — with live updates and severity color-coding.
- 04
Close the loop
back to Rules
An alert that doesn't add up sends you back to EveBox Rules to read the exact rule, its version history, and recent ruleset updates. Use that evidence in your Suricata ruleset workflow, then return to EveBox to finish triage.
EveBox Rules
Free hosted service · no account required to browse
A hosted platform for browsing and understanding Suricata rules. It keeps observed versions, preserves removed rules, and shows exactly what changed in each indexed ruleset update.
alert http $HOME_NET any -> $EXTERNAL_NET any ( msg:"EXAMPLE Suspicious HTTP Request"; content:"/old-path"; http_uri; sid:9000001; rev:1;)alert http $HOME_NET any -> $EXTERNAL_NET any ( msg:"EXAMPLE Suspicious HTTP Request"; content:"/new-path"; http_uri; reference:cve,2099-0001; sid:9000001; rev:2;)Per-update changelogs
Open a ruleset update to see added, modified, removed, enabled, disabled, and moved rules, with generated or feed-derived changes summarized separately.
Before and after, in full
Expand a modified entry to compare complete before/after rule text, revision changes, filename moves, and links to the rule detail and version history.
History that survives removal
Each observed rule version is kept as current, superseded, or removed. Removed rules retain working detail and history pages when you're investigating an older alert.
Search across many sources
Emerging Threats, abuse.ch, PawPatRules and more from one place. Search by SID, message and CVE, with per-rule detail pages, a sources catalog, and CVE browsing. Press / to jump to search.
Browse rules as files
Open a ruleset by original filename, page through its rules, and expand parsed details in place. Signed-in operators can switch to a reconstructed file view, and multi-feed sources expose each variant.
Personal lists and private access
Star rules for a personal working set; sign in with GitHub to keep them with your account. Access grants expose private rulesets only to the accounts they are shared with.
EveBox
Self-hosted · MIT licensed
EveBox turns Suricata's EVE event stream into an alert workflow you can clear and investigate: triage and automatically archive recurring noise, search stored events, and pull the packet evidence behind a detection.
Triage like an inbox
Archive noise, star and escalate real threats, and comment for the next analyst. Turn an alert into an auto-archive filter by SID, optionally narrowed to a source/destination pair or sensor, so recurring noise is cleared as it arrives.
Search and watch live
Search stored EVE events, filter the inbox by archived or escalated state, and watch new alerts stream in over SSE without refreshing the page.
Review a PCAP in one command
On Linux, run evebox oneshot --pcap against one or more local captures. EveBox processes them with Suricata in Podman or Docker, loads the EVE output, and opens the event viewer.
Packet capture on demand
Configure a local server or remote EveBox Agent capture spool, then download packets matching an event flow, a time window, or a custom BPF filter. Available in EveBox 0.27.
Start small or scale out
Run the embedded SQLite store for a self-contained installation, or use Elasticsearch 7.10+ or OpenSearch 2.6+ for a larger deployment.
One binary, flexible ingest
The Rust/Axum server and SolidJS UI ship together on port 5636. Read EVE JSON directly with SQLite, send events with the EveBox Agent, or keep an existing Filebeat or Logstash pipeline.
Shared DNA
One suite. Two tools. No pretending.
Suricata-native · Rust-backed · operator-focused · self-hosted + hosted · by Jason Ish
Clear licensing
EveBox is MIT licensed; the EveBox Rules web app is AGPL v3 and available as a free hosted service. Each product keeps its own deployment model and destination.
Run one, open one
Self-host EveBox alongside your EVE data. Open EveBox Rules in a browser with nothing to install and no account required for public rulesets.
Purpose-built stack
EveBox packages a Rust/Axum server with a SolidJS UI. EveBox Rules combines a Rust indexer with a SolidStart web app for its hosted rule workflows.
Suricata-native, by one author
Both tools speak Suricata's own vocabulary — EVE JSON, rules, rev, SIDs — and both are built by Jason Ish (@jasonish).
Get started
Two tools, two on-ramps
One you run, one you just open. Pick the half you need.
Run EveBox
self-hosted
Self-hosted alert manager — point it at your events and open :5636.
evebox server --datastore sqlite \
--input /var/log/suricata/eve.jsonevebox oneshot --pcap capture.pcapdocker run -it -p 5636:5636 \
jasonish/evebox:latest \
-e http://elasticsearch:9200- RPM / Deb package repositories
- Standalone binary download
- EveCtl — menu-driven Suricata + EveBox + Elasticsearch
- Bundled in ClearNDR Community Edition
Open EveBox Rules
free · hosted
Nothing to install — it's a free, hosted web service.
- Browse and search rules instantly, no account needed
- Review each indexed update with full before/after rule text
- Browse rulesets by original source file and feed variant
- Sign in with GitHub to keep a personal list of starred rules
- Press / anywhere to jump straight to search
FAQ
Common questions
Are EveBox and EveBox Rules the same product?
They're one suite, deliberately built as two focused tools. EveBox (at evebox.org) is the alert and event manager you self-host. EveBox Rules (at rules.evebox.org) is the free hosted rule platform. Same author and operating story — different products and deployment models.
Is it free?
Yes. EveBox is open source under the MIT license and free to self-host. The EveBox Rules web app is AGPL v3 and runs as a free public hosted service — open it and go.
Do I need Elasticsearch to run EveBox?
No. EveBox includes an embedded SQLite datastore for self-contained, lighter-load installations. For larger deployments, it supports Elasticsearch 7.10 or newer and OpenSearch 2.6 or newer.
Where do I download EveBox?
From evebox.org: a Docker image (jasonish/evebox), RPM/Deb repositories, raw binaries, or the menu-driven EveCtl. It's also bundled in ClearNDR Community Edition (formerly SELKS).
What is Suricata?
Suricata is the open-source IDS/IPS/NSM engine that inspects network traffic against detection rules and emits EVE JSON events and alerts. EveBox doesn't replace Suricata — it's the suite for operating the rules it runs and the alerts it produces.