search

StamusNetworks / scirius

Scirius is a web application for Suricata ruleset management and threat hunting.
GNU General Public License v3.0
614 stars 150 forks source link

Scirius / Suricata GUI problem #207

Open tenee opened 3 years ago

tenee commented 3 years ago

Hi everyone, I have a problem configuring Scirius with Suricata. launching the commands to start both, from termimal everything seems to work correctly and also the logs are written correctly. it seems that scirius is unable to intercept events

Suricata run command

sudo suricata -c /etc/suricata/suricata.yaml -i eth0

Scirius run command

python manage.py runserver < ip:port >

This is the configuration of suricata on scirius

image

The rules have been enabled in the graphical interface and during the suricata configuration, but scirius does not seem to detect any events:

1) image

2) image

also scirius does not load the menu on the right well:

image

The version of Suricata is 5.0.3 and the version of Scirius is 3.4.0

Could you give me some solution on how to solve the problem?

Thanks in advance

sgabe commented 3 years ago

Events should be loaded from ES. Are you sure that events are forwarded to ES and properly indexed?

tenee commented 3 years ago

How can I check that events are forwarded to ES and properly indexed? I installed ES following the installation of Suricata hoping that scirius would be able to represent the events but I don't understand why the events are not processed.

pevma commented 3 years ago

Is this still an issue? If you check in Kibana , do you have events populated?