Web interface for Suricata on NethServer 7

Subtitle: How To install and configure Web interface on ELK stack for Suricata

Version and revision: V1.0 / R 0.0.

For Nethserver 7

Accessible to: Intermediate / Advanced / Developer

Date of presentation: 2016-09-14

config setprop suricata EveLog yes
signal-event nethserver-suricata-update

Edit Logstash configuration file

vi /etc/logstash/conf.d/logstash.conf
input {
  file {
    path => ["/var/log/suricata/eve.json"]
    codec => json
    type => "eve-json"
    add_field => ["engine", "suricata"]
    sincedb_path => "/tmp/.sincedb_eve"

filter {

  if [type] == "eve-json" {
    date {
      match => [ "timestamp", "ISO8601" ]

  if [event_type] == "alert" {
    mutate {
      add_tag => ["inbox"]

  if [src_ip]  {
    geoip {
      source => "src_ip"
      target => "geoip"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    mutate {
      convert => [ "[geoip][coordinates]", "float" ]

output {
 stdout {
   codec => rubydebug
  elasticsearch {}
systemctl restart logstash

You can find Kibana templates here To get them work, you need to install the timelion plug-in of kibana via the following command

/opt/kibana/bin/kibana plugin -i elastic/timelion

To launch EveBox, download it and execute it:

cat > /etc/yum.repos.d/evebox.repo << EOF
yum -y install evebox
systemctl start evebox

To start EveBox at boot

systemctl enable evebox

Open EveBox port from local networks:

config set fw_evebox service status enabled TCPPort 5636 access private
signal-event firewall-adjust

Scirius is a web interface dedicated to Suricata ruleset management

yum -y install python-pip python-devel git gcc
git clone
cd scirius/

Install required python modules

pip install -r requirements.txt
pip install pyinotify
pip install gitdb
python syncdb
python runserver
python runserver

Open Scirius port from local networks:

config set fw_scirius service status enabled TCPPort 8000 access private
signal-event firewall-adjust

Delete Network Services [if the Webinterface not work or not be liked]

config delete fw_evebox
config delete fw_scirius
config delete fw_kibana
  • userguide/web_interface_for_suricata.txt
  • Last modified: 2017/06/05 19:52
  • by Aaron