WinSuricata Operations Console — Features and Functions

[Morpheus]

The WinSuricata Operations Console provides a centralized administrative interface for managing the operational components of a WinSuricata installation. Rather than requiring administrators to manually locate individual utilities, scheduled tasks, configuration files, and maintenance tools, the Operations Console brings these functions together into a single interface.

The console is also deployment-aware. Its available functions are determined by the components and options present in the particular WinSuricata installation. This allows the same Operations Console to be used on a standalone sensor, a centralized Host, or a Host configured for Remote Node deployment without presenting functions that are not applicable to that installation.

Email Notifications

The Enable Email Notifications option provides configuration for automated email reporting from the WinSuricata rule-update system.

Administrators can configure the SMTP server, port, sender address, recipientaddress, username, and password. SMTP credentials are protected using machine-scope Windows DPAPI rather than being stored as plain-text credentials.

The console also provides the Suppress "No Change" Emails option. When enabled, routine rule-update checks that produce no changes do not generate an email. Notifications are instead reserved for actual rule updates or errors.

The Test SMTP Settings function allows the configured email settings to be tested directly from the Operations Console.

ET Pro / Custom Rule Key

The Use ET Pro / Custom Rule Key option allows administrators to configure a private rule-feed key for Emerging Threats Pro or another supported custom rule source.

The key is stored using protected machine-scope configuration rather than being retained as unprotected plain text. This allows the rule updater to use the configured key while keeping the credential protected within the Windows installation.

Rule Update Scheduling

The Set Rule Update Schedule option provides automated scheduling for Suricata rule updates.

Administrators can specify the update interval using the available hour and minute selections. When enabled, the Operations Console creates and manages the Windows Scheduled Task used to execute the WinSuricata rule updater.

The scheduled task operates under the SYSTEM account with the required elevated execution level, allowing rule maintenance to continue without requiring an administrator to remain logged on.

Execute Immediate Rule Update

The Execute Immediate Rule Update function allows an administrator to manually initiate a rule update without waiting for the scheduled update interval.

The update utility is launched without displaying a separate console window, while its output is captured and displayed directly within the Operations Console. This gives the administrator immediate visibility into the update process and its results.

Manual execution also prevents the normal automated email notification process from generating a duplicate notification for the manually initiated update.

System & Environment Diagnostics

The System & Environment Diagnostics function performs a series of checks against the WinSuricata installation and its operating environment.

The diagnostic process verifies items including:

• Administrative privileges

• The configured WinSuricata root path

• Registry configuration

• Log write access

• The Suricata executable

• The Suricata configuration file

The results are reported directly in the Operations Console, providing an initial troubleshooting mechanism before more advanced investigation is required.

Remove Scheduled Task & Settings

The Remove Scheduled Task & Settings function removes the WinSuricata rule-update scheduled task and its associated configuration.

This provides administrators with a controlled method of returning the rule-update configuration to an unconfigured state without manually navigating through Windows Task Scheduler or deleting configuration files themselves.

The Operations Console also resets its displayed configuration to the appropriate default state following removal.

Service Monitor

The Activate Service Monitor function installs and activates the WinSuricata Service Monitor utility.

The monitor provides ongoing awareness of the WinSuricata service environment and allows the installation to automatically monitor the required components.

The Operations Console verifies the resulting installation by checking the relevant service, process, and registry state and reports the status through the integrated interface.

Cleanup and Restore

The Cleanup and Restore function provides access to the WinSuricata cleanup and restoration utility.

This capability is different from the Host-dependent functions described later in this document. Cleanup and Restore does not require OpenSearch or a Host installation.

Instead, its availability is determined by the Cleanup and Restore option selected during the original WinSuricata Headless Installer deployment.

If the option was enabled during the initial deployment, the Cleanup and Restore utility is made available through the Operations Console. If the option was not enabled, the corresponding utility is not made available.

This allows the original deployment configuration to determine whether the installation includes the additional cleanup and restoration capability.

OpenSearch PKI Checker

The OpenSearch-PKI-Checker provides a dedicated administrative utility for installations using the centralized WinSuricata Host and OpenSearch environment.

The checker is used to examine the certificate and trust configuration associated with the OpenSearch environment and provides a troubleshooting mechanism for identifying PKI-related configuration problems.

Because this function is specifically associated with the centralized Host/OpenSearch architecture, it is not presented on a standalone WinSuricata sensor.

Host Detected — Add Remote Node

The Host Detected - Add Remote Node function provides Host administrators with a direct method of initiating Remote Node deployment.

When the Operations Console detects the WinSuricata Host/OpenSearch environment, the option becomes available. Selecting it expands the interface to provide fields for:

• Remote Node Alias

• Remote Node IP Address

The console validates the supplied information and then launches the WinSuricata Node Setup utility with the configured node information.

This allows a Host administrator to begin Remote Node provisioning directly from the Operations Console rather than manually locating and launching the Node Setup utility.

Dynamic Operations Interface

The Operations Console does not use a fixed interface for every WinSuricata deployment.

When additional configuration sections are enabled, the interface dynamically adjusts itself to accommodate the expanded controls. For example, enabling Email Notifications or Remote Node provisioning changes the available form area and integrated log display so that the additional controls can be presented without unnecessarily enlarging the overall interface.

This provides a consistent management experience while allowing additional functionality to appear only when required.

Installation-Dependent Operations

The Operations Console automatically adapts its available functions based on the components and options configured during the original WinSuricata deployment.

This prevents functions from being presented when the required underlying component or installation option is not available.

Host-Dependent Functions

Two Operations Console functions are specifically dependent on detection of the WinSuricata Host/OpenSearch environment:

OpenSearch-PKI-Checker

The OpenSearch-PKI-Checker is displayed when the Operations Console detects the WinSuricata OpenSearch Host environment.

It provides access to the dedicated PKI verification utility used to examine the certificate and trust configuration supporting centralized OpenSearch.

A standalone WinSuricata sensor without the Host/OpenSearch installation does not display this function.

Host Detected — Add Remote Node

The Host Detected - Add Remote Node function is also displayed only when a WinSuricata Host/OpenSearch installation is detected.

When selected, the Operations Console provides the Remote Node Alias and Remote Node IP Address fields required to initiate node provisioning.

After validation, the console launches the WinSuricata Node Setup utility and passes the supplied information to the provisioning process.

A standalone WinSuricata sensor therefore does not display the Remote Node provisioning controls.

Deployment-Option-Dependent Functions

Cleanup and Restore demonstrates a different type of availability condition.

It is not dependent on Host detection. Instead, it depends on whether the feature was selected during the original Headless Installer deployment.

This means that a standalone sensor can have Cleanup and Restore available, while another standalone sensor may not, depending on the options selected during its initial installation.

The Operations Console therefore reflects the original deployment decision rather than assuming that the feature exists on every installation.

How the Console Adapts

The result is an Operations Console that can support multiple WinSuricata deployment configurations.

Function	Standalone Sensor	Host Sensor	Availability Condition
Email Notifications	Available	Available	None
ET Pro / Custom Rule Key	Available	Available	None
Rule Update Scheduling	Available	Available	None
Immediate Rule Update	Available	Available	None
System & Environment Diagnostics	Available	Available	None
Scheduled Task & Settings Removal	Available	Available	None
Service Monitor	Available	Available	None
Cleanup and Restore	If enabled	If enabled	Initial Headless Installer option
OpenSearch PKI Checker	Not available	Available	Host/OpenSearch detection
Add Remote Node	Not available	Available	Host/OpenSearch detection

Deployment-Aware Administration

This deployment-aware design is an important part of the Operations Console.

The console does not simply provide a fixed collection of administrative buttons on every system. Instead, it determines which capabilities are appropriate for the particular WinSuricata installation and exposes those functions accordingly.

A standalone sensor receives the tools required to manage its local Suricata deployment, rule updates, diagnostics, monitoring, and other locally configured functions.

A Host installation additionally receives the OpenSearch PKI and Remote Node management capabilities required for centralized operation.