https://jasonish.org/atom.xml

Wow, my last EveBox update on this blog was in 2017, but it's not dead.

Target Audience This quick guide is intended for those who would like to develop and/or make changes to Suricata.

Note: This guide has been superseded by Quick Guide to Building and Testing Suricata on Linux, which covers both Ubuntu and Fedora distributions.

This post is out of date and references images and links that no longer exist.

Following up on EveBox support for SQLite, I've created a screencast demo of oneshot mode.

The latest builds of EveBox support an embedded SQLite database that allow it to be used without Elastic Search for lighter loads.

I've been asked a few times now for "stable" APT and Yum repositories as the current ones are marked "development", in fact they contain the packages created on Travis-CI runs of the master branch.

I've added a new tool to my idstools package to convert the packets (or the payloads) found in Suricata eve logs to a pcap file.

Fedora Linux 21 and 22 have Suricata 2.0.8 in their default repositories making it very easy to get started.

July 21, 2021 -- This tool is no longer maintained.

If you got here looking for Suricata RPMs, please head over https://forum.suricata.io/t/guide-suricata-rpms-for-centos-and-fedora/752 I have created a Suricata Beta yum repository for CentOS/EL 7 to accompany the stable repo which includes the just releas…

I recently installed some honeypot software and am logging the traffic with Suricata into Elastic Search with Logstash.

I've updated the Suricata RPM for EL 7 to 2.0.5.

[2016-07-25: This information is no longer valid, header over to https://codemonkey.net/suricata-rpms/ for up to date links.]

While getting familiar the very popular Docker Linux container tool, I went against best practice and put Suricata, Logstash, Elastic Search and Kibana into a container that is looking promising for demonstration purposes.

Kibana is really good for getting a high level overview of your Suricata events, but I didn't find it very useful for reviewing individual events, and I'm not really sure if Kibana is really built around that idea, so I created EveBox, a web based event v…

I've made some changes to my simple to install and use PCAP spool web frontend Dumpy including: A rewrite in Go, mostly for entertainment purposes, but the really easy to use concurrency, and single binary installation make Go a good choice for small appl…

After having fun with Suricata's new eve/json logging format and the Logstash/Elastic Search/Kibana combination (see this and this), I wanted to get my Snort events into Elastic Search as well.

I recently consolidated my Python code bits for dealing with Snort and Suricata unified2 log files into a project called idstools.

Sometimes the best way to try out a new framework or language is to apply it to a domain you already know very well, even if it does happen to reinvent the wheel.

As mentioned in my previous post on using embedded Jetty with SpringMVC, I was going to look at simplifying the application by using Thymeleaf instead of JSPs as a view technology.

As an accidental Java developer I've never been comfortable deploying applications into a container, especially when the web interface is secondary to the primary purpose of the application.

Note: These RPMs no longer exist.

Just looked at my web stats for the first time in a long time and I see that one of the most requested resources are my libevent examples, which no longer exist here.

Recent issues with Linux on a laptop has given me the desire to try working on a Mac again.

Probably the most lacking feature in most multi-screen setups is the ability to move a window from one screen to another with a keyboard shortcut.

Multi-monitor configurations are great but I think they leave out some usability aspects that could really make life easier for the keyboard user.

Yes, covered everywhere and I've done it enough time I should know it off by heart now...

I plan to use this blog to post codebits that I find myself sending to people over and over again.