Events Viewer Tab

User Guide for Event Management System #

Welcome to the User Guide for the Event Management System, a sophisticated tool designed for real-time event handling, querying, and management based on Suricata events and using Redis for data storage. This guide provides you with the necessary information to interact with the system effectively, utilizing its comprehensive set of features.

System Overview #

The Event Management System offers a robust backend solution for managing and analyzing network security events. It interfaces through RESTful APIs and is designed to facilitate seamless interactions with event data, making it ideal for integration into web applications.

Key Features #

1. Event Retrieval by Type:

   • Retrieve events based on their type, such as alerts or logs.

   • Usage: Send a GET request to /events/type/{event_type} with optional offset and limit query parameters to paginate results.

2. Event Search by Name:

   • Look up events by specific names or identifiers within the events.

   • Usage: Access through /events/name/{event_name} to fetch relevant event data.

3. Event Count by Type:

   • Get a count of how many events of a certain type are stored.

   • Usage: Use the endpoint /events/count/{event_type} to receive an integer count.

4. Detailed Event Information:

   • Fetch detailed information of an event by its unique ID.

   • Usage: Query /events/details/{event_type}/{event_id} to get a comprehensive view of a single event.

5. Event Deletion:

   • Delete events by type, removing them from the database.

   • Usage: Send a DELETE request to /events/delete/{event_type} to clear all events of that type.

6. Advanced Search Capabilities:

   • Perform advanced searches combining multiple parameters such as source IP, destination IP, ports, and protocol.

   • Usage: Navigate to /events/search with the necessary query parameters to filter the results according to your needs.

7. Time-Shifted Event Retrieval:

   • Retrieve events within a specific time frame relative to the current time.

   • Usage: The endpoint /events/timeshift/{event_type} accepts timeshift (hours), offset, and limit parameters to customize the temporal scope of the query.

CORS Support #

• All HTTP responses include CORS (Cross-Origin Resource Sharing) headers, allowing integration into diverse client environments across different domains.

Error Handling #

• The system is designed to handle errors gracefully, providing meaningful error messages in the HTTP response to assist in debugging and integration efforts.

Configuration and Setup #

• System configuration is managed through a configuration file (config++.conf), which includes settings such as the path to the fast.log file and Redis connection parameters.

Retrieving Fast.log Content #

• The system can directly serve the contents of the fast.log file, providing real-time access to raw log data.

• Usage: Access this feature through the endpoint /fastlog, which returns the content of the fast.log file.

Integration Tips #

• Ensure that your client application is configured to handle JSON responses effectively, as all data exchanged with the backend is in JSON format.

• Utilize the provided CORS headers if the API is consumed from web applications hosted on different domains.

This user guide aims to equip you with the knowledge to utilize the Event Management System efficiently. Whether for application integration or network monitoring, the system provides a powerful toolkit for managing and analyzing security events.