Fully Automated Windows Suricata Installer (Looking for GUI Console Collaboration)

1

Hello Suricata Community,

I’ve been working on a project called WinIDS Suricata - a fully automated Suricata installer for Windows 10/11 and Server. The goal is simple: run one script, get a fully functioning Suricata IDS.

What’s Working :white_check_mark:

  • One script installation - Everything is automated from start to finish

  • Suricata engine - Latest version installed and running as a Windows service

  • Npcap - Packet capture driver installed and configured

  • Rules management - suricata-update integrated, rules combined and validated

  • Alert logging - Events are successfully being written to eve.json

  • Service integration - Suricata starts automatically with Windows

  • Firewall configuration - Suricata is allowed through Windows Firewall

  • Self-contained - Portable Python, Git, and NSSM all installed locally

What I’m Looking For :bullseye:

The missing piece is a dedicated GUI console for Windows. I’ve tried:

  • EveBox - Runs but hangs on Elasticsearch detection (even with SQLite config)

  • Watcher - React frontend works but had dependency issues

  • HTML dashboard - Works but is basic, just parses the JSON file

What I’d Love to Collaborate On :handshake:

  1. A native Windows GUI console for Suricata alerts

  2. A lightweight web interface that actually works on Windows (no Elasticsearch requirement)

  3. A React/Vue dashboard that connects directly to eve.json

  4. EveBox configuration guidance - If anyone has it working on Windows without Elasticsearch

What I Can Offer :light_bulb:

  • Automation expertise - The installer is fully automated and PowerShell-based

  • Testing - I can test any solution on Windows 11

  • Integration - Can integrate any working GUI into the installer

  • Documentation - I’ll document everything for the community

Quick Setup Details

  • Installation Directory: D:\Winids

  • Config File: D:\Winids\Suricata\suricata.yaml

  • Alert Log: D:\Winids\Logs\eve.json

  • Service Name: Suricata

  • Suricata Version: 8.0.6

  • Install Type: Full Windows service with auto-start

Current HTML Dashboard (Functional but Basic)

text

🛡️ WinIDS Alerts

[ICMP Traffic Detected]
192.168.1.1 → 192.168.1.150
2026-08-05T16:20:15.123456-0600

[TCP Traffic Detected]
192.168.1.100 → 8.8.8.8
2026-08-05T16:20:20.654321-0600

The ask…

If anyone has:

  • Experience with EveBox on Windows (without Elasticsearch)

  • A working Watcher deployment on Windows

  • A custom GUI solution for Suricata alerts

  • Just good advice on the best GUI approach for Windows

I’d be grateful for your insights and would love to collaborate on finishing this project. The installer is solid and ready for production use - it just needs a polished face.

Check out the project repository (coming soon) or DM me if you’re interested in collaborating.

Thanks for reading!

Edit: The installer handles everything automatically. If you have a Windows machine, you can test it. The whole process takes about 8-10 minutes and you have a fully working IDS, minus the GUI frontend.