EveBox is a full-stack security event management system for Suricata EVE JSON logs. It provides a Rust backend (Axum, SQLx, Tokio) with a SolidJS/TypeScript web frontend, supporting both Elasticsearch/OpenSearch and embedded SQLite datastores. The system ingests Suricata EVE logs via file spool, Unix socket, or remote agent, and offers real-time dashboards, alert aggregation, PCAP extraction, file analysis, and agent management. It includes a CLI with subcommands for server, agent, oneshot processing, PCAP operations, and backend administration. The architecture is modular: an EventRepo trait abstracts datastore operations, a filter chain processes events during ingestion, and a query parser converts user search syntax into backend-specific filters. The agent subsystem uses a persistent WebSocket control channel for remote event submission, PCAP capture, and file retrieval. The frontend is a single-page application with dashboards for alerts, DNS, TLS, HTTP, SSH, DHCP, and anomalies, using Chart.js for visualizations and Server-Sent Events for live updates. While primarily an application, EveBox also exhibits data-processing characteristics: it transforms raw EVE JSON into structured events, enriches them with GeoIP and rule metadata, and supports aggregation and search across large event sets. However, its core purpose is operational security monitoring rather than data analysis or research.