$ show jasonish/evebox
EveBox is a full-stack security event management system for Suricata EVE JSON logs. It provides a Rust backend (Axum, SQLx, Tokio) with a SolidJS/TypeScript web frontend, supporting both Elasticsearch/OpenSearch and embedded SQLite datastores. The system ingests Suricata EVE logs via file spool, Unix socket, or remote agent, and offers real-time dashboards, alert aggregation, PCAP extraction, file analysis, and agent management. It includes a CLI with subcommands for server, agent, oneshot processing, PCAP operations, and backend administration. The architecture is modular: an EventRepo trait abstracts datastore operations, a filter chain processes events during ingestion, and a query parser converts user search syntax into backend-specific filters. The agent subsystem uses a persistent WebSocket control channel for remote event submission, PCAP capture, and file retrieval. The frontend is a single-page application with dashboards for alerts, DNS, TLS, HTTP, SSH, DHCP, and anomalies, using Chart.js for visualizations and Server-Sent Events for live updates. While primarily an application, EveBox also exhibits data-processing characteristics: it transforms raw EVE JSON into structured events, enriches them with GeoIP and rule metadata, and supports aggregation and search across large event sets. However, its core purpose is operational security monitoring rather than data analysis or research.
The LLM identified 5 files worth highlighting for reuse:
Defines an EventRepo enum that dispatches all data operations (alerts, events, aggregation, stats) to either ElasticEventRepo or SqliteEventRepo implementations. This trait-based abstraction decouples the server and CLI from backend-specific logic, making it easy to add new datastores or swap implementations. The pattern is cleanly isolated and could be extracted for any multi-backend data access layer.
Parses user search strings into structured QueryElement values supporting field filters (key:value), time ranges, tags (is:archived), and operators. The parser is backend-agnostic and used by both SQLite and Elasticsearch event repositories. It demonstrates non-obvious skill in handling complex search syntax with error recovery, and is reusable in any application requiring a flexible query language.
Implements an EveFilterChain that applies a sequence of filters (GeoIP, rule enrichment, auto-archive, firehose) to each ingested EVE event. Each filter implements a simple trait with an apply() method, making the chain extensible and testable. This pattern is reusable for any event processing pipeline where multiple independent transformations are needed.
Provides a modular PCAP extraction engine with spool file discovery, rotation-group merging, BPF/flow filtering, time-window pruning, and streaming output via a bounded channel. The design separates concerns into spool, filter, fetch, and writer modules, each independently testable. This could be extracted for any project needing efficient PCAP extraction with cancellation and progress tracking.
Implements a persistent WebSocket control channel for remote agents with exponential backoff reconnection, capability negotiation, and job dispatch. Uses a ChannelWriter to bridge blocking PCAP/file reads into async mpsc channels with cancellation support. The pattern of bounded, cancellable streaming with progress tracking is reusable for any agent-server protocol requiring reliable data transfer.