===============================================================================
WinIDS v4.0 Deployment Framework
EveBox Standalone Console — SQLite Edition
(Add-On Package)
Installation Guide
Copyright © 2026 WinSnort.com | Michael Steele
===============================================================================
This package provides an automated deployment framework for adding the EveBox Web Console and embedded SQLite storage backend to an existing WinIDS / Suricata installation.
• EveBox Web Interface (Port 5636)
• Embedded SQLite Database Engine
• Live EVE JSON Ingestion Pipeline
• Automated Windows Service Management & Recovery
===============================================================================
PHASE I: PRE-DEPLOYMENT SPECIFICATIONS
===============================================================================
TARGET ENVIRONMENT
• Windows 10 / Windows 11 (64-bit) or Windows Server (2016–2025) (64-bit)
• WinSuricata Sensor — Headless Engine Edition MUST be installed prior to setup.
• Existing active WinIDS / Suricata installation (generating eve.json)
• Local Administrator privileges required
• Active Internet connection recommended (for initial binary retrieval)
DEPLOYMENT MODEL
EveBox Console Add-On running an embedded SQLite database engine to ingest and visualize Suricata event telemetry.
PACKAGE SECURITY & INTEGRITY
• Archive Password : w1nsn03t.c0m
• SHA-1 Hash : 4AC5D4A01210F14B4F4871A17B59D9B57C20DF7F
ARCHIVE HANDLING
• Extract the full ZIP archive before running setup. DO NOT run installers directly from inside the ZIP file.
• Preserve all directory structures contained within the archive.
IMPORTANT NOTICE
This package is a component add-on and REQUIRES the prior installation of the WinSuricata Sensor — Headless Engine Edition.
This setup registers background Windows Services and configures local firewall rules to serve the EveBox web UI. Ensure your WinSuricata engine is fully installed and actively producing 'eve.json' logs before proceeding.
===============================================================================
PHASE II: PACKAGE CONTENTS
===============================================================================
EveBox-SQLite-Installer.exe
Automated EveBox & SQLite deployment utility.
WinSuricata-Cleanup-Restore.exe
Uninstall and disaster recovery utility Includes additional EveBox & SQLite components.
===============================================================================
PHASE III: INSTALLATION PROCEDURE
===============================================================================
STEP 1: EXTRACT PACKAGE
Extract the complete production ZIP archive to a dedicated folder.
Example: D:\Staging\EveBox-SQLite
(Do not rename or remove files prior to setup.)
STEP 2: RUN ADD-ON INSTALLER
Right-click 'EveBox-SQLite-Installer.exe' -> Select 'Run as administrator'
The framework will validate your environment, provision the SQLite database, register the EveBox service, and hook into your Suricata 'eve.json' log stream.
===============================================================================
PHASE IV: ARCHITECTURE OVERVIEW & RESILIENCY
===============================================================================
AUTOMATED PIPELINE
• DATABASE INITIALIZATION : Provisions and optimizes the embedded SQLite engine for high-throughput event storage and local querying out of the box.
• SERVICE REGISTRATION : Configures EveBox as a native Windows Service via NSSM with automatic recovery and restart flags.
• EVE INGESTION PIPELINE : Establishes live monitoring of the Suricata eve.json output stream to ingest, index, and surface alert telemetry directly into the SQLite backend.
• WEB INTERFACE BINDING : Deploys and exposes the lightweight EveBox web UI on port 5636 for local or network threat analysis.
COMPONENT STACK
• EVEBOX: Web-based alert management and threat analysis console.
• SQLITE: Embedded high-performance transactional database backend.
• NSSM: Service wrapper managing background execution and fault recovery.
• EVE JSON: Structured event log source stream generated by Suricata.
===============================================================================
PHASE V: POST-DEPLOYMENT MANAGEMENT & ACCESS
===============================================================================
CONSOLE ACCESS
• Browser access: 'http://localhost:5636' (or via the generated Desktop/Start Menu shortcut).
• Features an inbox-style alert triage dashboard, event search, and telemetry graph views.
SYSTEM REBOOT
• Recommended (optional). Refreshes environment PATH variables and verifies the EveBox Windows Service auto-start condition.
===============================================================================
PHASE VI: TROUBLESHOOTING
===============================================================================
1. DEPENDENCY DOWNLOAD FAILS
- Review installer console output and log files.
- Verify Internet connectivity and check write permissions on temporary directories.
- Re-run installer (cached downloads will automatically be reused).
2. EVEBOX CONSOLE UNREACHABLE
- Confirm the EveBox service state in 'services.msc'.
- Verify local port binding status at 'http://localhost:5636'.
- Check Windows Firewall rules to ensure port 5636 is allowed locally.
3. EVEBOX DISPLAYS NO EVENTS
- Confirm the core Suricata service is running and generating fresh 'eve.json' data.
- Verify the 'eve.json' file path configured during setup is valid and accessible.
- Ensure read permissions are granted on the target Suricata log directory.
===============================================================================
FINAL DEPLOYMENT CHECKLIST
===============================================================================
[ ] WinSuricata Sensor — Headless Engine Edition installed and running
[ ] SHA-1 hash verified before extraction
[ ] Archive extracted to local directory using archive password
[ ] Add-On installer executed with Administrator privileges
[ ] EveBox service active and bound to port 5636
[ ] Local dashboard accessible at http://localhost:5636
[ ] EveBox ingesting live alerts from Suricata 'eve.json'
[ ] Desktop and Start Menu shortcuts generated
[ ] System reboot performed (recommended)
===============================================================================
TECHNICAL DOCUMENTATION & SUPPORT
===============================================================================
WinSnort.com
Website: https://winsnort.com
Maintainer: Michael Steele
===============================================================================
