scirius icon indicating copy to clipboard operation
scirius copied to clipboard

Scirius / Suricata GUI problem

Open tenee opened this issue 5 years ago • 3 comments

Hi everyone, I have a problem configuring Scirius with Suricata. launching the commands to start both, from termimal everything seems to work correctly and also the logs are written correctly. it seems that scirius is unable to intercept events

Suricata run command

sudo suricata -c /etc/suricata/suricata.yaml -i eth0

Scirius run command

python manage.py runserver < ip:port >

This is the configuration of suricata on scirius

image

The rules have been enabled in the graphical interface and during the suricata configuration, but scirius does not seem to detect any events:

image

image

also scirius does not load the menu on the right well:

image

The version of Suricata is 5.0.3 and the version of Scirius is 3.4.0

Could you give me some solution on how to solve the problem?

Thanks in advance

tenee avatar Aug 24 '20 10:08 tenee

Events should be loaded from ES. Are you sure that events are forwarded to ES and properly indexed?

sgabe avatar Aug 25 '20 15:08 sgabe

How can I check that events are forwarded to ES and properly indexed? I installed ES following the installation of Suricata hoping that scirius would be able to represent the events but I don't understand why the events are not processed.

tenee avatar Aug 26 '20 13:08 tenee

Is this still an issue? If you check in Kibana , do you have events populated?

pevma avatar Oct 05 '20 06:10 pevma