Morpheus

============================================================== WinIDS v4.0 Deployment Framework EveBox + OpenSearch + OpenSSL Console — Enterprise Edition (Add-On Package) Installation Guide Copyright © 2026 WinSnort.com | Michael Steele ============================================================== This package provides an automated deployment framework for adding the EveBox Web Console, OpenSearch Analytics Engine, and OpenSSL PKI certificate generation to an existing WinIDS / Suricata installation. • EveBox Web Interface (Port 5636) • OpenSearch Enterprise Analytics Engine • OpenSSL Automated CA & TLS Certificate Generation • HTTPS-Secured Live EVE Ingestion Pipeline • OpenSearch PKI Validation & Recovery Utility ====================================== PHASE I: PRE-DEPLOYMENT SPECIFICATIONS ====================================== TARGET ENVIRONMENT • Windows 10 / Windows 11 (64-bit) or Windows Server (2016–2025) (64-bit) • Existing active WinIDS / Suricata installation (generating eve.json) • Local Administrator privileges required • Active Internet connection recommended (for initial binary retrieval) PACKAGE SECURITY & INTEGRITY • Archive Password : w1nsn03t.c0m • SHA-1 Hash : 8F3A29311165D1BA432EBC172B01B6EB33506B0E DEPLOYMENT MODEL EveBox Console Add-On backed by OpenSearch enterprise search and OpenSSL TLS encryption to ingest, index, and secure Suricata event telemetry. ARCHIVE HANDLING • Extract the full ZIP archive before running setup. DO NOT run installers directly from inside the ZIP file. • Preserve all directory structures contained within the archive. IMPORTANT NOTICE This package configures background Windows Services, issues local SSL/TLS certificates, and updates firewall rules. Ensure your core Suricata engine is already installed and actively producing `eve.json` logs before proceeding. ====================================== PHASE II: PACKAGE CONTENTS ====================================== EveBox-OpenSearch-Installer.exe Primary automated setup utility for EveBox, OpenSearch, and OpenSSL. WinSuricata-OpenSearch-PKI-Check.exe OpenSearch PKI and security validation and recovery utility. README-INSTALL.txt Complete step-by-step installation instructions and technical reference guide. ====================================== PHASE III: INSTALLATION PROCEDURE ====================================== STEP 1: EXTRACT PACKAGE Extract the complete production ZIP archive to a dedicated folder. Example: D:\Staging\EveBox-OpenSearch (Do not rename or remove files prior to setup.) STEP 2: RUN PRIMARY EVEBOX OPENSEARCH INSTALLER Right-click 'EveBox-OpenSearch-Installer.exe' -> Select "Run as administrator". The framework will deploy OpenSearch, configure Java heap parameters, and set up the EveBox service automatically. ====================================== PHASE IV: ARCHITECTURE OVERVIEW & RESILIENCY ====================================== AUTOMATED PIPELINE • SEARCH ENGINE INITIALIZATION: Provisions OpenSearch analytics cluster optimized for high-volume event indexing and rapid querying out of the box. • PKI CERTIFICATE GENERATION : Leverages OpenSSL to generate private CAs, issue TLS certificates, and enforce encrypted HTTPS transport across nodes. • PKI HEALTH VALIDATION : WinSuricata-OpenSearch-PKI-Check verifies required CA, node, administrative certificate, and private key assets. • SECURITY CONFIGURATION : Validates and reapplies the OpenSearch TLS/security configuration when PKI assets require regeneration or reinitialization. • SERVICE REGISTRATION : Registers OpenSearch and EveBox as native Windows Services via NSSM with automatic recovery and restart flags. • EVE INGESTION PIPELINE : Establishes live monitoring of the Suricata `eve.json` output stream to stream alert telemetry into OpenSearch indexes. COMPONENT STACK • EveBox : Web-based alert triage, threat analysis, and search console. • OpenSearch: Enterprise distributed search engine for log indexing and analytics. • OpenSSL : Cryptographic toolkit providing TLS encryption and local certificate generation. • PKI Check : WinSuricata-OpenSearch-PKI-Check provides certificate health validation, regeneration, and OpenSearch security configuration recovery. • EVE JSON : Structured event log source stream generated by Suricata. RECOVERY & SYSTEM RESTORE • RESUME CAPABILITY: If a dependency download fails mid-stream, place the asset manually into $TempDir and re-run. The installer detects valid files and resumes. • PKI RECOVERY: If OpenSearch certificate assets are missing or become invalid after deployment, execute WinSuricata-OpenSearch-PKI-Check.ps1 as Administrator. The utility validates the PKI environment and can regenerate required certificate and key assets before restoring the OpenSearch TLS/security configuration. ====================================== PHASE V: POST-DEPLOYMENT MANAGEMENT & ACCESS ====================================== PKI & OPENSEARCH SECURITY MAINTENANCE • WinSuricata-OpenSearch-PKI-Check.ps1 may be executed independently after deployment. • Run the utility as Administrator when certificate validation, PKI repair, or OpenSearch security reconfiguration is required. • The utility verifies the OpenSSL installation and required Root CA, node, and administrative certificate assets. • Missing PKI components can be regenerated automatically using the existing WinSuricata OpenSSL installation. • Node and administrative private keys are converted to the PKCS#8 format required by the OpenSearch security configuration. • OpenSearch `opensearch.yml` is updated with the required TLS/SSL security directives as required. • The utility provides a recovery path without requiring a complete EveBox/OpenSearch reinstallation. CONSOLE ACCESS • Browser access: `http://localhost:5636` (or via the generated Desktop/Start Menu shortcut). • Provides an inbox-style alert triage dashboard, event searching, and timeline telemetry. SYSTEM REBOOT • Recommended (optional). Refreshes environment PATH variables and verifies the OpenSearch and EveBox Windows Service auto-start states. ====================================== PHASE VI: TROUBLESHOOTING ====================================== 1. DEPENDENCY DOWNLOAD FAILS • Review installer console output and log files. • Verify Internet connectivity and check write access on $TempDir. • Re-run installer (valid cached downloads will be reused). 2. OPENSEARCH FAILS TO START • Verify OpenSearch service status in `services.msc`. • Check SSL certificate file paths and system access permissions in config directories. • Ensure system RAM meets minimum Java Virtual Machine (JVM) heap requirements. • Run 'WinSuricata-OpenSearch-PKI-Check.ps1' as Administrator to verify the OpenSearch PKI and TLS configuration. 3. SSL CERTIFICATE / PKI ERROR • Verify the OpenSSL binaries are present in the framework OpenSSL directory. • Run 'WinSuricata-OpenSearch-PKI-Check.ps1' as Administrator. • The utility will check the Root CA, node certificate, administrative certificate, private keys, and PKCS#8 key assets. • Missing certificate assets can be regenerated automatically. • The OpenSearch TLS/security configuration will be reapplied as required. • After completion, verify that the WinIDS-OpenSearch service is running and that HTTPS access to OpenSearch on port 9200 is available. 4. EVEBOX CONSOLE UNREACHABLE • Confirm the EveBox service is active in `services.msc`. • Verify local port binding status at `http://localhost:5636`. • Check Windows Firewall settings for blocked local endpoints. 5. EVEBOX DISPLAYS NO EVENTS • Confirm core Suricata is actively writing fresh data to `eve.json`. • Ensure the OpenSearch service is running and healthy over HTTPS. • Check firewall rules for local service communication blocks. ====================================== FINAL DEPLOYMENT CHECKLIST ====================================== [ ] SHA-1 hash verified before extraction [ ] Archive extracted to a local directory using archive password [ ] 'suricata.conf' updated with correct installation paths [ ] Primary add-on installer executed with Administrator privileges [ ] WinSuricata-OpenSearch-PKI-Check.ps1 included in deployment package [ ] PKI validation completed and required certificates issued [ ] SSL/TLS configuration verified [ ] OpenSearch security configuration verified [ ] OpenSearch service active and listening over secure HTTPS [ ] EveBox web console accessible at http://localhost:5636 [ ] EveBox ingesting live alerts from Suricata `eve.json` into OpenSearch [ ] Desktop and Start Menu shortcuts generated [ ] System reboot performed (recommended) ====================================== TECHNICAL DOCUMENTATION & SUPPORT ====================================== WinSnort.com Website: https://winsnort.com Maintainer: Michael Steele

============================================================== WinIDS v4.0 Deployment Framework WinSuricata Sensor — Engine Edition (Headless / No Console) Installation Guide Copyright © 2026 WinSnort.com | Michael Steele =============================================================== This package contains an automated Windows Intrusion Detection and Security Monitoring deployment framework built around: • Suricata IDS/IPS Engine • Npcap Packet Capture Driver • Native suricata-update Engine via Cygwin Subsystem • WinSuricata Operations Console (Unified Management, Resiliency & Real-Time Monitoring Hub) • System Cleanup and Recovery Utilities The framework automates installation, configuration, driver binding, and service integration for a high-performance, headless WinIDS sensor node. ====================================== PHASE I: PRE-DEPLOYMENT SPECIFICATIONS ====================================== TARGET ENVIRONMENT • Windows 10 / Windows 11 (64-bit) or Windows Server (2016–2025) (64-bit) • Local Administrator privileges required • Active Internet connection recommended (for dependency downloads) DEPLOYMENT MODEL Standalone, high-performance Windows sensor running pure Suricata IDS/IPS, managed centrally via the built-in WinSuricata Operations Console. PACKAGE SECURITY & INTEGRITY • Archive Password : w1nsn03t.c0m • SHA-1 Hash : EFCEC908D6626CE8A1F5E71B09C8FA75DA286A62 ARCHIVE HANDLING • Extract the full ZIP archive before running setups. DO NOT run installers directly from inside the ZIP file. • Preserve all directory structures contained within the archive. IMPORTANT NOTICE This installation configures Windows services, packet capture drivers, firewall rules, and optionally system restore points. Always verify configuration parameters prior to execution. ====================================== PHASE II: PACKAGE CONTENTS ====================================== WinSuricata-Headless-Installer.exe Primary WinIDS automated setup and deployment utility. WinSuricata-Operations-Console.exe Unified management interface handling real-time service controls, granular SMTP notification configurations, Suricata Pro key integration, automated and manual rule updates, health diagnostics, and real-time log monitoring. WinSuricata-Silent-Rules-Updater.exe Under-the-hood background executable invoked by the Operations Console for automated rule updates, syntax validation, and rollback routines. WinSuricata-Cleanup-Restore.exe Under-the-hood background executable invoked by the Operations Console for WinIDS cleanup, uninstall, and disaster recovery utility. WinSuricata-TrayMonitor.exe Lightweight system tray monitor utility that runs in the background, providing quick visual status indicators and a convenient menu to start, stop, and restart critical WinIDS services directly from the taskbar notification area. suricata.conf Core deployment configuration file containing target path variables. winids.ico Application icon file for desktop and Start Menu shortcuts. ====================================== PHASE III: INSTALLATION PROCEDURE ====================================== STEP 1: EXTRACT PACKAGE Extract the complete production ZIP archive to a dedicated folder. Example: D:\Staging\WinIDS-Install (Do not rename or remove files prior to setup.) STEP 2: REVIEW CONFIGURATION Open 'suricata.conf' in Notepad and adjust the required path variables: $WinIDSRoot = "D:\WinSuricata" # Primary installation directory $TempDir = "D:\Temp" # Temporary download directory $EnableRestorePoint = 1 # Set to 0 to skip System Restore STEP 3: RUN PRIMARY INSTALLER Right-click 'WinSuricata-Headless-Installer.exe' -> Select "Run as administrator". The framework will execute a bare-metal setup in under 4 minutes. ====================================== PHASE IV: ARCHITECTURE OVERVIEW & RESILIENCY ====================================== AUTOMATED PIPELINE • PACKET CAPTURE : Validates and deploys Npcap drivers required for Windows network interface binding and promiscuous packet sniffing. • CORE ENGINE : Streams and extracts the latest stable 64-bit Windows release of Suricata binaries. • RULE MANAGEMENT : Deploys a targeted Cygwin subsystem environment on initial execution to run the native "suricata-update" utility seamlessly under Windows. • SERVICE REGISTRY: Registers Suricata as a native Windows Service via NSSM with automatic recovery flags. COMPONENT STACK • Suricata : Network IDS engine handling packet inspection and alert generation. • Npcap : Packet capture library allowing Suricata to sniff traffic on Windows interfaces. • Cygwin Engine: Posix compatibility runtime hosting the official native "suricata-update" tool. • EVE JSON : Structured event data output generated by Suricata for downstream parsing. • Python : Automation engine for managing setup scripts and log processing. • NSSM : Service wrapper that runs Suricata background services on Windows. • Git : Version control utility used for pulling rule updates and framework code. WINDSURICATA OPERATIONS CONSOLE ARCHITECTURE & RESILIENCY The WinSuricata Operations Console (`WinSuricata-Operations-Console.exe`) serves as the central management hub, bringing enterprise-grade control and resiliency: • UNIFIED SERVICE CONTROL : Start, stop, restart, and monitor the live status of the Suricata Windows Service directly from an interactive graphical dashboard. • SMTP NOTIFICATION : Configure granular email alerts for Success, Failure, and No Change states with global toggles and an instant Test SMTP button. • SURICATA PRO KEY : Directly input and manage your Suricata Pro key inside the GUI for seamless subscription rule downloads. • RULE MANAGEMENT : Fully integrates native "suricata-update" processes with all standard operational parameters and automated scheduled task options. • SCHEDULED AUTOMATION : Toggle and configure automated scheduled tasks for rule updates (operating on 15-minute intervals plus randomized offsets) directly from the interface. • INTELLIGENT HASH : Calculates SHA-256 baselines of remote/compiled rule sets and skips execution if no new rules are published. • PRE-UPDATE BACKUPS : Automatically creates a verified snapshot of active rules prior to applying updates. • VALIDATION & ROLLBACK : Tests newly compiled rules against "suricata.exe" engine syntax before loading. If validation fails, it restores the previous working rule set automatically and maintains service uptime. • REAL-TIME LOG AUDITING: Features a live status window displaying detailed feedback as actions occur, appending rule update deltas, SHA baselines, and rollbacks to logs. WINDSURICATA SYSTEM TRAY MONITOR The package includes 'WinSuricata-TrayMonitor.exe', which registers as a native Windows Service to monitor sensor health in real time: • TASKBAR INTEGRATION : Sits quietly in the system tray with live status indicators. • QUICK SERVICE CONTROL: Right-click menu allows administrators to instantly start, stop, or restart core WinIDS services without opening the full operations console. RECOVERY & SYSTEM RESTORE • RESUME CAPABILITY: If a download fails mid-stream, place the asset manually into $TempDir and re-run. The framework detects cached files and resumes instantly. • SYSTEM RESTORE : Creates a clean pre-installation restore point on Workstations (automatically bypassed on Windows Server OS). ====================================== PHASE V: POST-DEPLOYMENT MANAGEMENT & ACCESS ====================================== OPERATIONS & MAINTENANCE • Access via the Suricata Start Menu or Desktop Shortcuts: 'WinSuricata Operations Console'. • Provides a centralized interface for manual/scheduled rule updates, service control, health checks, System Cleanup/Restore and log monitoring on demand. • Cygwin and python/pip dependencies are installed automatically on initial setup. SYSTEM REBOOT • Recommended (optional). Refreshes environment PATH variables and verifies Windows Service auto-start states. ====================================== PHASE VI: TROUBLESHOOTING ====================================== 1. DEPENDENCY DOWNLOAD FAILS - Review installer console output and log files. - Verify Internet connectivity and check write access on $TempDir. - Re-run installer (valid cached downloads will be reused). 2. SURICATA SERVICE FAILS TO START - Confirm driver initialization by verifying Npcap binding state. - Run "suricata.exe -c suricata.yaml -T" from command prompt to test syntax. - Check Windows Event Viewer under Application logs for crash events. 3. RULE UPDATE ROLLBACK OR FAILURE - Review logs via the Operations Console or check "$LogsPath\RulesUpdate.log". - Verify network connectivity to threat intelligence providers. - Test rule syntax manually via engine validation commands. 4. NO NETWORK TRAFFIC DETECTED - Verify interface GUID or index numbers inside the deployed "suricata.yaml". - Ensure the correct network interface is selected for sniffing mode. ====================================== FINAL DEPLOYMENT CHECKLIST ====================================== [ ] SHA-1 hash verified before extraction [ ] Archive extracted to a local directory using password [ ] 'suricata.conf' updated with correct installation paths [ ] Primary installer executed with Administrator privileges [ ] Packet capture driver (Npcap) verified [ ] Suricata engine running as a registered Windows Service [ ] Start Menu shortcuts verified ('WinSuricata Operations Console' launched for initial check) [ ] System Tray Monitor service ('WinSuricataTrayMonitor') verified and running [ ] Desktop and Start Menu shortcuts generated [ ] System reboot performed (recommended) ====================================== TECHNICAL DOCUMENTATION & SUPPORT ====================================== WinSnort / WinIDS / WinSuricata Website: https://winsnort.com Maintainer: Michael Steele ======================================

=============================================================================== WinIDS v4.0 Deployment Framework EveBox Standalone Console — SQLite Edition (Add-On Package) Installation Guide Copyright © 2026 WinSnort.com | Michael Steele =============================================================================== This package provides an automated deployment framework for adding the EveBox Web Console and embedded SQLite storage backend to an existing WinIDS / Suricata installation. • EveBox Web Interface (Port 5636) • Embedded SQLite Database Engine • Live EVE JSON Ingestion Pipeline • Automated Windows Service Management & Recovery =============================================================================== PHASE I: PRE-DEPLOYMENT SPECIFICATIONS =============================================================================== TARGET ENVIRONMENT • Windows 10 / Windows 11 (64-bit) or Windows Server (2016–2025) (64-bit) • WinSuricata Sensor — Headless Engine Edition MUST be installed prior to setup. • Existing active WinIDS / Suricata installation (generating eve.json) • Local Administrator privileges required • Active Internet connection recommended (for initial binary retrieval) DEPLOYMENT MODEL EveBox Console Add-On running an embedded SQLite database engine to ingest and visualize Suricata event telemetry. PACKAGE SECURITY & INTEGRITY • Archive Password : w1nsn03t.c0m • SHA-1 Hash : 6F0310EB36876AB3722EC7B306C5D2EA4D26C1ED ARCHIVE HANDLING • Extract the full ZIP archive before running setup. DO NOT run installers directly from inside the ZIP file. • Preserve all directory structures contained within the archive. IMPORTANT NOTICE This package is a component add-on and REQUIRES the prior installation of the WinSuricata Sensor — Headless Engine Edition. This setup registers background Windows Services and configures local firewall rules to serve the EveBox web UI. Ensure your WinSuricata engine is fully installed and actively producing 'eve.json' logs before proceeding. =============================================================================== PHASE II: PACKAGE CONTENTS =============================================================================== EveBox-SQLite-Installer.exe Automated EveBox & SQLite deployment utility. WinSuricata-Cleanup-Restore.exe Uninstall and disaster recovery utility Includes additional EveBox & SQLite components. =============================================================================== PHASE III: INSTALLATION PROCEDURE =============================================================================== STEP 1: EXTRACT PACKAGE Extract the complete production ZIP archive to a dedicated folder. Example: D:\Staging\EveBox-SQLite (Do not rename or remove files prior to setup.) STEP 2: RUN ADD-ON INSTALLER Right-click 'EveBox-SQLite-Installer.exe' -> Select 'Run as administrator' The framework will validate your environment, provision the SQLite database, register the EveBox service, and hook into your Suricata 'eve.json' log stream. =============================================================================== PHASE IV: ARCHITECTURE OVERVIEW & RESILIENCY =============================================================================== AUTOMATED PIPELINE • DATABASE INITIALIZATION : Provisions and optimizes the embedded SQLite engine for high-throughput event storage and local querying out of the box. • SERVICE REGISTRATION : Configures EveBox as a native Windows Service via NSSM with automatic recovery and restart flags. • EVE INGESTION PIPELINE : Establishes live monitoring of the Suricata eve.json output stream to ingest, index, and surface alert telemetry directly into the SQLite backend. • WEB INTERFACE BINDING : Deploys and exposes the lightweight EveBox web UI on port 5636 for local or network threat analysis. COMPONENT STACK • EVEBOX: Web-based alert management and threat analysis console. • SQLITE: Embedded high-performance transactional database backend. • NSSM: Service wrapper managing background execution and fault recovery. • EVE JSON: Structured event log source stream generated by Suricata. =============================================================================== PHASE V: POST-DEPLOYMENT MANAGEMENT & ACCESS =============================================================================== CONSOLE ACCESS • Browser access: 'http://localhost:5636' (or via the generated Desktop/Start Menu shortcut). • Features an inbox-style alert triage dashboard, event search, and telemetry graph views. SYSTEM REBOOT • Recommended (optional). Refreshes environment PATH variables and verifies the EveBox Windows Service auto-start condition. =============================================================================== PHASE VI: TROUBLESHOOTING =============================================================================== 1. DEPENDENCY DOWNLOAD FAILS - Review installer console output and log files. - Verify Internet connectivity and check write permissions on temporary directories. - Re-run installer (cached downloads will automatically be reused). 2. EVEBOX CONSOLE UNREACHABLE - Confirm the EveBox service state in 'services.msc'. - Verify local port binding status at 'http://localhost:5636'. - Check Windows Firewall rules to ensure port 5636 is allowed locally. 3. EVEBOX DISPLAYS NO EVENTS - Confirm the core Suricata service is running and generating fresh 'eve.json' data. - Verify the 'eve.json' file path configured during setup is valid and accessible. - Ensure read permissions are granted on the target Suricata log directory. =============================================================================== FINAL DEPLOYMENT CHECKLIST =============================================================================== [ ] WinSuricata Sensor — Headless Engine Edition installed and running [ ] SHA-1 hash verified before extraction [ ] Archive extracted to local directory using archive password [ ] Add-On installer executed with Administrator privileges [ ] EveBox service active and bound to port 5636 [ ] Local dashboard accessible at http://localhost:5636 [ ] EveBox ingesting live alerts from Suricata 'eve.json' [ ] Desktop and Start Menu shortcuts generated [ ] System reboot performed (recommended) =============================================================================== TECHNICAL DOCUMENTATION & SUPPORT =============================================================================== WinSnort.com Website: https://winsnort.com Maintainer: Michael Steele ===============================================================================