I want to user web gui suritaca

1

Hello team,
I want to view logs Suricata over dashboard is it possible and any recommend some dashboard ?
Best regards,

2

I’m personally using Jason’s Evebox https://evebox.org/

3

Does it is get real time event or not sir ?

4

Its somewhat real time. Events are added to the database as Logstash/Filebeat/Evebox Agent pick them up. As for the UI, it refreshes every minute or on demand to show you the latest alerts in an aggregate form.

5

Can U guide me to do this please sir.

6

You can read into the doc Try EveBox | EveBox

8

Hello sir,
I just set up Impulse-xdr already in the same server with Suricata but I dont know how to view logs suricata on impulse-xdr can U guide me how to view suricata logs on Impulse-xdr please
Best regards,

9

Hi Le,

You need to start with a clean instance, if you already have Suricata running - there will be a conflict.

Just create a new VM and install the manager with these settings in its .conf

AGENT_TYPE=heavy
NIDS_ENABLED=true

Regards

10

Hello,

This is interesting, what kind of throughput can this GUI implementation
handle and also what kind of NICs? FPGA and PF_RING or AF_PACKET for example?

Greg

11

One other observation, from what I understand it requires an end user to
deinstall their current Suricata implementation; this is not practical,
some of us have highly customized Suricata implementations, or I am
misunderstanding what has been said so far about it?

Greg

12

Hi,

The EDR agent implements Suricata via the jasonish/suricata image. The agent is installed on a “monitoring VM/host” that is completely decoupled from the rest of the setup, so you can set any amount of CPU/RAM and can have any type of NIC. It will be able to handle the level of throughput that Suricata typically achieves.

Here is the overall flow for clarity:

  1. EDR is installed on monitoring VM
  2. Logs are first stored in /var/impulse/log/suricata and then shipped to a Postgres database on the Impulse Manager using Rsyslog.
  3. On the manager, there is a module that does some basic analytics and prepares the data for display.

The rsyslog + postgres + analytics_module pipeline can handle any amount of log messages.

In terms of setup customization, it comes with a pre-configured suricata.yaml file that sets logging options, interface and HOME_NET value but you can customise anything else.

Regards

13

Ok interesting, may give it a try, thank you.

Greg