Setting up on Windows10

[mesteele]

I'm interested in setting up evebox in windows. I'm unable to find any documentation. I have Suricata setup and have the latest x64 version of evebox for Windows. I am now scratching my head as what to do next?

[jasonish]

Yeah, the docs need to get a little better. There is no specific support for Windows, so the program is still very unix-like in terms of usage, but it does run just fine on Windows. First, I'd get the development build. It has better support for the embedded database due to some recent work that hasn't been released yet: https://evebox.org/files/development/

Then: https://docs.evebox.org/en/release/server-running.html#using-the-embedded-sqlite-database

I unfortunately didn't have any luck getting Suricata to work in my Windows VM, but did confirm that EveBox worked. You would run in a terminal like: evebox.exe -D *<DIR>* --datastore sqlite --input /path/to/eve.json.

Then open your browser to http://localhost:5636.

I don't see a Windows installer coming anytime soon, but would be curious what could make this a better experience on Windows.