Fully Automated Windows Suricata Installer (Looking for GUI Console Collaboration)

Uncategorized
1

Hello Suricata Community,

I’ve been working on a project called WinIDS Suricata - a fully automated Suricata installer for Windows 10/11 and Server. The goal is simple: run one script, get a fully functioning Suricata IDS.

What’s Working :white_check_mark:

  • One script installation - Everything is automated from start to finish

  • Suricata engine - Latest version installed and running as a Windows service

  • Npcap - Packet capture driver installed and configured

  • Rules management - suricata-update integrated, rules combined and validated

  • Alert logging - Events are successfully being written to eve.json

  • Service integration - Suricata starts automatically with Windows

  • Firewall configuration - Suricata is allowed through Windows Firewall

  • Self-contained - Portable Python, Git, and NSSM all installed locally

What I’m Looking For :bullseye:

The missing piece is a dedicated GUI console for Windows. I’ve tried:

  • EveBox - Runs but hangs on Elasticsearch detection (even with SQLite config)

  • Watcher - React frontend works but had dependency issues

  • HTML dashboard - Works but is basic, just parses the JSON file

What I’d Love to Collaborate On :handshake:

  1. A native Windows GUI console for Suricata alerts

  2. A lightweight web interface that actually works on Windows (no Elasticsearch requirement)

  3. A React/Vue dashboard that connects directly to eve.json

  4. EveBox configuration guidance - If anyone has it working on Windows without Elasticsearch

What I Can Offer :light_bulb:

  • Automation expertise - The installer is fully automated and PowerShell-based

  • Testing - I can test any solution on Windows 11

  • Integration - Can integrate any working GUI into the installer

  • Documentation - I’ll document everything for the community

Quick Setup Details

  • Installation Directory: D:\Winids

  • Config File: D:\Winids\Suricata\suricata.yaml

  • Alert Log: D:\Winids\Logs\eve.json

  • Service Name: Suricata

  • Suricata Version: 8.0.6

  • Install Type: Full Windows service with auto-start

Current HTML Dashboard (Functional but Basic)

text

🛡️ WinIDS Alerts

[ICMP Traffic Detected]
192.168.1.1 → 192.168.1.150
2026-08-05T16:20:15.123456-0600

[TCP Traffic Detected]
192.168.1.100 → 8.8.8.8
2026-08-05T16:20:20.654321-0600

The ask…

If anyone has:

  • Experience with EveBox on Windows (without Elasticsearch)

  • A working Watcher deployment on Windows

  • A custom GUI solution for Suricata alerts

  • Just good advice on the best GUI approach for Windows

I’d be grateful for your insights and would love to collaborate on finishing this project. The installer is solid and ready for production use - it just needs a polished face.

Check out the project repository (coming soon) or DM me if you’re interested in collaborating.

Thanks for reading!

Edit: The installer handles everything automatically. If you have a Windows machine, you can test it. The whole process takes about 8-10 minutes and you have a fully working IDS, minus the GUI frontend.

2

Hello Suricata Community,

I’m pleased to share an update on my WinIDS/WinSuricata project. Since my original post, the project has continued to evolve, and what began as a fully automated Suricata installer for Windows has grown into WinSuricata v4.5, a modular deployment framework supporting standalone installations, centralized enterprise management, and remote sensor nodes.

The original goal remains the same: make deploying and managing Suricata on Windows as straightforward and automated as possible. However, the project has grown well beyond the initial single-script installation, with separate deployment options designed for different environments and use cases.

What’s New in WinSuricata v4.5

WinSuricata now provides multiple deployment configurations built around a common installation framework.

  • Core Edition – Automated deployment of the Suricata detection engine, Npcap packet capture, rule management, Windows service integration, and EVE JSON logging.

  • Standalone Edition – A self-contained Suricata deployment with EveBox using SQLite, providing an alert interface without requiring OpenSearch or Elasticsearch.

  • Enterprise Host Edition – An integrated deployment combining Suricata, EveBox, OpenSearch, and the supporting certificate infrastructure for centralized event management.

  • Remote Node Agent Edition – Extends an existing WinSuricata Core installation with the EveBox Agent, allowing remote sensors to forward events to a central EveBox host.

  • Automated configuration and integration – PowerShell-based installation, service management, dependency handling, firewall configuration, and supporting utilities.

  • Modular architecture – Separate deployment options allow users to install only the components required for their environment rather than deploying one large, all-in-one stack.

From Standalone Sensors to Centralized Management

One of the biggest changes is the ability to build a deployment around the user’s requirements.

A standalone Windows machine can run Suricata and provide local alert viewing through EveBox and SQLite. Larger environments can use an Enterprise Host to centralize event collection, with remote Windows sensors forwarding their events through EveBox Agent.

This provides a path from a single Windows IDS installation to a distributed sensor environment without requiring every machine to run the entire stack.

What the Project Has Achieved

The framework builds on the original installation’s core functionality:

  • Automated Suricata installation and Windows service configuration.

  • Npcap installation and packet-capture integration.

  • Automated rule management using suricata-update.

  • EVE JSON event generation and logging.

  • Local dependency management and supporting utilities.

  • Optional alert visualization, centralized event storage, and remote sensor integration.

  • Supporting documentation for installation, configuration, and operation.

The focus has also expanded beyond simply getting Suricata running. The project now addresses deployment consistency, service lifecycle management, certificate infrastructure, remote-node integration, and recovery considerations for multi-node environments.

What I’m Still Interested in Exploring

Although the project has progressed considerably, I’m still interested in collaborating with the Suricata community, particularly around:

  1. EveBox and remote-agent integration – Improving visibility into remote-node connectivity, presence, and health.

  2. Windows deployment best practices – Identifying opportunities to improve reliability, performance, and maintainability.

  3. Centralized sensor management – Exploring practical approaches to managing distributed Suricata sensors from a Windows-based host.

  4. Community feedback and testing – Hearing from users who deploy Suricata on Windows in standalone or enterprise environments.

Why I Built It

My objective has been to reduce the complexity of deploying Suricata on Windows while retaining the flexibility needed for different environments.

Rather than requiring users to assemble every component and configure each dependency manually, WinSuricata aims to automate that process and provide clearly defined deployment options.

The project is developed primarily in PowerShell, with an emphasis on repeatable installations, modular components, Windows service integration, and detailed documentation.

Project Status

WinSuricata v4.5 represents a significant step forward from the original WinIDS installer. What started as an effort to automate a basic Windows IDS installation has evolved into a modular framework supporting standalone monitoring, centralized enterprise deployments, and remote sensor integration.

I’m sharing this update to reconnect with the community, highlight the project’s progress, and invite feedback from anyone interested in running Suricata on Windows.

If you’re working with Suricata on Windows, deploying remote sensors, or integrating EveBox into a centralized monitoring environment, I’d welcome your thoughts and suggestions.

Thank you to everyone in the Suricata community who shares knowledge, develops tools, and helps make open-source network security more accessible.

— WinSuricata Project