search

jasonish / evebox

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search
https://evebox.org/
MIT License
423 stars 67 forks source link

Inbox result can be very large #261

Closed jasonish closed 4 months ago

jasonish commented 1 year ago

While the inbox view might be paginated, it's returned in one http response. This can be quite large if the grouping results in a large number of distinct IP address pairs. To start, the response could just return the fields needed to build the inbox display rather than the full event.

A further step would be to only send back the first page of results, doing some server side pagination. Server side pagination was not initially used as it was not supported the Elastic aggregation queries, but it may be supported now.

jasonish commented 4 months ago

Fixed, only what is needed for the alert views is retrieved and sent now.

If using ECS, a lot of data is sent, that is another project.