EveBox is a full-stack security event management system for Suricata EVE JSON logs. It provides a Rust backend (Axum, SQLx, Tokio) with a SolidJS/TypeScript web frontend, supporting both Elasticsearch/OpenSearch and embedded SQLite datastores. The system ingests Suricata EVE logs via file spool, Unix socket, or remote agent, and offers real-time dashboards, alert aggregation, PCAP extraction, file analysis, and agent management. It includes a CLI with subcommands for server, agent, oneshot processing, PCAP operations, and backend administration. The architecture is modular: an EventRepo trait abstracts datastore operations, a filter chain processes events during ingestion, and a query parser converts user search syntax into backend-specific filters. The agent subsystem uses a persistent WebSocket control channel for remote event submission, PCAP capture, and file retrieval. The frontend is a single-page application with dashboards for alerts, DNS, TLS, HTTP, SSH, DHCP, and anomalies, using Chart.js for visualizations and Server-Sent Events for live updates. While primarily an application, EveBox also exhibits data-processing characteristics: it transforms raw EVE JSON into structured events, enriches them with GeoIP and rule metadata, and supports aggregation and search across large event sets. However, its core purpose is operational security monitoring rather than data analysis or research.
Zui (formerly Brim) is an Electron-based desktop application for network security monitoring and data exploration. It provides a graphical interface to query and visualize data stored in a Zed/SuperDB lake, with a focus on Zeek and Suricata log analysis. The application supports importing packet captures (pcap), structured logs (Zeek TSV, NDJSON, CSV, Parquet), and offers a rich query editor (Monaco), histogram, table/inspector views, and export workflows. The codebase is a monorepo (Yarn workspaces, Nx) with packages for type definitions (`superdb-types`), a Node.js client (`superdb-node-client`), sample data, and an e2e test framework (`app-player`). The architecture follows a domain-driven pattern with handlers and operations, a Redux store with versioned state migrations, and a plugin system for extensibility. While the application is actively maintained and functionally rich, it exhibits some technical drift due to a mix of legacy and modern patterns, a large migration history, and tight coupling between core and plugins.
This is a SaltStack-based configuration management repository for Security Onion, a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. The repository contains thousands of Salt states, Jinja templates, shell scripts, Python modules, and configuration files that automate the deployment and orchestration of a distributed security monitoring grid. The architecture is role-based, with distinct node types (manager, sensor, standalone, search node, hypervisor, etc.) each receiving tailored Salt states. Core services include Elasticsearch, Kibana, Logstash, Kafka, Redis, Zeek, Suricata, Strelka file scanner, Elastic Fleet/Agent, and a web-based Security Onion Console (SOC). The codebase demonstrates consistent patterns: per-service `map.jinja` merging defaults with pillar data, `enabled.sls`/`disabled.sls` toggling, license-gated features via `allowed_states.map.jinja`, and extensive use of Docker containers with static IPs on a custom bridge network. While the repository is actively maintained and follows professional SaltStack practices, it suffers from high repetition, hardcoded paths, and tight coupling between components, making reuse outside the Security Onion ecosystem difficult. Notable reusable components include the threat-intelligence analyzer framework, the YAML manipulation CLI utility `so-yaml.py`, and the Elasticsearch ingest pipeline normalization patterns.