I want to user web gui suritaca

Hello team,
I want to view logs Suricata over dashboard is it possible and any recommend some dashboard ?
Best regards,

I’m personally using Jason’s Evebox https://evebox.org/

Does it is get real time event or not sir ?

Its somewhat real time. Events are added to the database as Logstash/Filebeat/Evebox Agent pick them up. As for the UI, it refreshes every minute or on demand to show you the latest alerts in an aggregate form.

Can U guide me to do this please sir.

You can read into the doc Try EveBox | EveBox

Hello sir,
I just set up Impulse-xdr already in the same server with Suricata but I dont know how to view logs suricata on impulse-xdr can U guide me how to view suricata logs on Impulse-xdr please
Best regards,

Hi Le,

You need to start with a clean instance, if you already have Suricata running - there will be a conflict.

Just create a new VM and install the manager with these settings in its .conf




This is interesting, what kind of throughput can this GUI implementation
handle and also what kind of NICs? FPGA and PF_RING or AF_PACKET for example?


One other observation, from what I understand it requires an end user to
deinstall their current Suricata implementation; this is not practical,
some of us have highly customized Suricata implementations, or I am
misunderstanding what has been said so far about it?



The EDR agent implements Suricata via the jasonish/suricata image. The agent is installed on a “monitoring VM/host” that is completely decoupled from the rest of the setup, so you can set any amount of CPU/RAM and can have any type of NIC. It will be able to handle the level of throughput that Suricata typically achieves.

Here is the overall flow for clarity:

  1. EDR is installed on monitoring VM
  2. Logs are first stored in /var/impulse/log/suricata and then shipped to a Postgres database on the Impulse Manager using Rsyslog.
  3. On the manager, there is a module that does some basic analytics and prepares the data for display.

The rsyslog + postgres + analytics_module pipeline can handle any amount of log messages.

In terms of setup customization, it comes with a pre-configured suricata.yaml file that sets logging options, interface and HOME_NET value but you can customise anything else.


Ok interesting, may give it a try, thank you.