I know that report in suricata like fast.log can be customized using lua script (fast.lua) but is it possible to use bash script to have the similar custom report like fast.sh? I’m more familar with bash scripting.
There is no direct bash support, no. You could use different outputs, especially the advanced eve output and use postprocessing.
Thanks for the suggestion. Can we make the eve output only display alert log like fast.log? There are a bunch of JSON data in eve output even if alert is not triggered. I think this can be customized in suricata.yaml, but there are too many of them. Can anyone show me this config that will make eve.json output the similar thing from fast.log ?
suricata.yaml you will want to limit the
types that are logged to just
alert. See this part of the YAML:
And remove all types from that array except
alert, and you will only get alerts. It’ll still be JSON, but should align with what you see in
Thank you so much, I will try this.