- Upgrade to Angular 4 and Angular CLI 1.0 and use its AOT compilation
feature reducing the Javascript size even further. Combined with
response compression, initial data loaded by the browser is about
7-8x less. - Compress HTTP responses speeding up initial load times.
- New "oneshot" mode - a mode where EveBox directly reads in an
eve.log file into an SQLite database for one time viewing, then
cleans up after itself. - The EveBox server can now process an eve file without an agent
(basically an embedded agent), storing the events in Elastic Search
or SQLite - When using Elastic Search 5.2+, use the update_by_query API to
archive and escalate events. This should speed up archiving. - Fix Elastic Search keyword handling when Filebeat is used to send
eve logs directly to Elastic Search. - Reports:
- In addition to the event views, there are now some report views.
- EveBox Agent:
- The EveBox agent is a replacement for Filebeat and/or Logstash. It
can read Suricata eve log files sending them to the EveBox server
which will then store them to the configured data store (Elastic
Search or SQLite).
- The EveBox agent is a replacement for Filebeat and/or Logstash. It
- SQLite Support:
- SQLite can now be used as a backend. This is suitable for smaller
installations where event load is light. - Reports are currently not supported with SQLite.
- SQLite can now be used as a backend. This is suitable for smaller
- If the agent is being used to submit events and the datastore is
Elastic Search, create a template if one doesn't already index for
the configured index. For Elastic Search 2.x and Logstash 2 template
is used, for Elastic Search 5.x and Logstash 5 template is used. - A start on some documentation:
http://evebox.readthedocs.io/en/latest/index.html
Download at https://evebox.org/.