Front End for Suricata

[spetrillo]

Hello all,

Is anyone using a front end web app for Suricata or just using the alert section in the OPNsense gui?

Thanks,
Steve

[BeNe]

I'm still using the OPNsense gui. But i will push the events into a ELK-Stack with a Dashboard.
That's the best opinion in my eyes to get the most out of the logs.

[spetrillo]

It seems I am heading down the same path. I am building an ELK stack on a Windows box but how do you push the logs to the other device? Is there a config to tell Suricata to send the logs?

[BeNe]

If you use an ELK Stack, you can install Logtash (that´s the "L" in the ELK) on your OPNsense.
So you can push the needed logs.

Or you can use default Syslog daemon that comes with the OPNsense if you don´t wont to change to much on your Firwall. In Suricata enable syslog alerts.

There is an Logtash config for OPNSense around from fabian -> https://github.com/fabianfrz/opnsense-logstash-config

For ELK itself, there are already great dashboard for Suricata.

[spetrillo]

Aha...so I only need the E and K on my other machine...thanks for clarifying that!