Suricata

Check your command line, it looks like you want:

evebox server -e http://xxx.31.16.151:9200

As for where you install EveBox, if you are using Logstash or Filebeat+Logstash to process the logs into Suricata, EveBox can go pretty much everywhere. If you want EveBox to process the log files, then yes, you have to run it where the log files are. Or you could just run the agent part where the logs are which would then forward the logs to an EveBox server running elsewhere: https://evebox.readthedocs.io/en/0.11.1/agent.html

If you have Elasticsearch available, something like:

BOOKMARK_DIRECTORY=/tmp evebox server -e http://elasticsearch:9200 --input /var/log/suricata/eve.json

--host 0.0.0.0

If you do not have Elasticsearch, you could try something like:

BOOKMARK_DIRECTORY=/tmp evebox server --host 0.0.0.0 --datastore sqlite --input /var/log/suricata/eve.json

Yes, i have a suricata and evebox installed on same server and other server having only elasticsearch(no logstash/filebeat).

Two queries here:
1.
When i execute : BOOKMARK_DIRECTORY=/tmp evebox server e http://xxx.31.16.xxx:9200 --input /var/log/suricata/eve.json
--------------------
2020-07-02 10:51:51 (server.go:163) <Info> -- This is EveBox Server version 0.11.1 (rev: 4d1b355); os=linux, arch=amd64
2020-07-02 10:51:51 (server.go:252) <Info> -- Self test: found embedded index.html.
2020-07-02 10:51:51 (geoip-service.go:44) <Warning> -- Failed to initialize geoip database: no database files found
2020-07-02 10:51:51 (configdb.go:52) <Info> -- Using in-memory configuration DB.
2020-07-02 10:51:51 (migrator.go:79) <Info> -- Updating database to version 0.
2020-07-02 10:51:51 (migrator.go:79) <Info> -- Updating database to version 1.
2020-07-02 10:51:51 (server.go:387) <Error> -- Managed PostgreSQL datastore requires a data-directory
-------------
Do i need to configure anything here to avoid this error(Managed PostgreSQL datastore requires a data-directory)

2.Do i need to add this in any specific file (--host 0.0.0.0)? if i want to connect evebox from the browser.

Punith Raya wrote in #note-5:

Do i need to configure anything here to avoid this error(Managed PostgreSQL datastore requires a data-directory)

Did you copy the sample configuration file, evebox.yaml.example to evebox.yaml? That provides an example of using PostgreSQL, probably not what you want. The command lines above assume no configuration file, so your best off to delete it.

2.Do i need to add this in any specific file (--host 0.0.0.0)? if i want to connect evebox from the browser.

If you want to connect with a browser from a different machine yes. If just connecting from localhost, then no.

Hello Jason,

I have configured authentication section in evebox.yaml file and below

authentication:

1. Default: false
2. env: EVEBOX_AUTHENTICATION_REQUIRED
   required: true
   --host 0.0.0.0
3. Type of login required:
4. - username -- just a username...
5. - usernamepassword -- username and password
6. env: EVEBOX_AUTHENTICATION_TYPE
   type: usernamepassword
   --------------------
   When is execute below command:
   [root@ip-xx-xx-xx-xx /]# BOOKMARK_DIRECTORY=/tmp evebox server --host 0.0.0.0 --datastore sqlite --input /var/log/suricata/eve.json
   2020-07-04 17:10:32 (server.go:163) <Info> -- This is EveBox Server version 0.11.1 (rev: 4d1b355); os=linux, arch=amd64
   2020-07-04 17:10:32 (server.go:252) <Info> -- Self test: found embedded index.html.
   2020-07-04 17:10:32 (geoip-service.go:44) <Warning> -- Failed to initialize geoip database: no database files found
   2020-07-04 17:10:32 (configdb.go:52) <Info> -- Using in-memory configuration DB.
   2020-07-04 17:10:32 (migrator.go:79) <Info> -- Updating database to version 0.
   2020-07-04 17:10:32 (migrator.go:79) <Info> -- Updating database to version 1.
   2020-07-04 17:10:32 (server.go:364) <Error> -- SQLite datastore requires a data-directory
   ---------------------

Added the my user by using config tool:
--------------
evebox config users D /var/lib/evebox add --username xxx
-------------
Still am not able to connect evebox from the Browser, when to access like -http://[Public IP of the server]:5636/.

Please let me know if anything am missing.

Oops, I missed an argument in the command line I gave you:

BOOKMARK_DIRECTORY=/tmp evebox server --host 0.0.0.0 --datastore sqlite --input /var/log/suricata/eve.json -D /some/directgory

This is the output and still http://[Public IP of the server]:5636/ is not reachable.

[root@ip-xxx-xx-xx-xx evebox]# BOOKMARK_DIRECTORY=/tmp evebox server --host 0.0.0.0 --datastore sqlite --input /var/log/suricata/eve.json D /var/lib/evebox
2020-07-05 14:09:06 (server.go:163) <Info> - This is EveBox Server version 0.11.1 (rev: 4d1b355); os=linux, arch=amd64
2020-07-05 14:09:06 (server.go:252) <Info> -- Self test: found embedded index.html.
2020-07-05 14:09:06 (geoip-service.go:44) <Warning> -- Failed to initialize geoip database: no database files found
2020-07-05 14:09:06 (configdb.go:59) <Info> -- Using configuration database file /var/lib/evebox/config.sqlite
2020-07-05 14:09:06 (sqlite.go:140) <Info> -- Configuring SQLite datastore
2020-07-05 14:09:06 (sqlite.go:146) <Info> -- SQLite event store using file /var/lib/evebox/events.sqlite
2020-07-05 14:09:06 (sqlite.go:94) <Info> -- Retention period: 0 days
2020-07-05 14:09:06 (server.go:449) <Info> -- Configuring internal eve log reader
2020-07-05 14:09:06 (server.go:131) <Info> -- Session reaper started
2020-07-05 14:09:06 (server.go:165) <Info> -- Authentication disabled.
2020-07-05 14:09:06 (server.go:261) <Info> -- Listening on [0.0.0.0]:5636
2020-07-05 14:09:06 (purger.go:45) <Info> -- Initializing event retention scheduler: period = 0 days
2020-07-05 14:09:06 (bookmarker.go:71) <Info> -- Using bookmark file /tmp/b264daf6271f51125d20d5a7715e8947.bookmark
2020-07-05 14:09:06 (bookmarker.go:159) <Info> -- Found valid bookmark, jumping to offset 10064

I think this is now probably the firewall on the system running EveBox. You may need to open port 5636.

Issue got fixed, please ignore above comments.
Thanks for the help :)

Just last one question: Is there any limitation of event handling by evebox?

It looks like you are using SQLite, so you'll want to set a retention period as SQLite becomes very heavy quickly. I suggest 3 days. This is done with the configuration file:

data-directory: /var/lib/evebox
database:
  type: sqlite
  retention-period: 3

input:
  enabled: true
  filename: "/var/log/suricata/eve.json" 
  bookmark-directory: /var/lib/evebox