Evebox
A web-based GUI for viewing and managing Suricata EVE security events stored in Elasticsearch or SQLite.
What is Evebox?
EveBox is a web-based graphical interface for viewing and managing Suricata EVE (Extensible Event Format) security events. It connects to Elasticsearch or uses an embedded SQLite database to provide security analysts with search capabilities and alert management through an intuitive inbox-style interface. The tool helps security teams efficiently triage and investigate network intrusion alerts generated by Suricata.
Security analysts, network administrators, and SOC teams who need to monitor and manage Suricata intrusion detection system alerts through a web interface.
EveBox offers a lightweight, self-hosted alternative to commercial security event viewers with specific optimization for Suricata's EVE format. Its inbox approach to alert management and support for both Elasticsearch and embedded SQLite makes it flexible for various deployment scenarios.
Overview
Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search
Use Cases
Best For
- Monitoring Suricata alerts in Elasticsearch through a web interface
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
