Suri Oculus 4.0: The Biggest Project Update Yet
Development of Suri Oculus 4.0 is nearing completion. This is one of the most significant updates to the project so far, with major changes across the backend, web interface, Suricata rule management, event processing, and supporting tools.
The main goal of version 4.0 is to make Suri Oculus not only a convenient interface for viewing Suricata events, but also a practical tool for everyday network activity analysis and system management.
Search in fast.log
Suri Oculus 4.0 introduces search functionality for fast.log.
Events can now be searched directly from the web interface, without manually browsing large log files or relying on external command-line tools.
This is particularly useful when investigating specific signatures, IP addresses, or other data in environments where fast.log contains a large number of events.
Improved Suricata Rule Management
The rule management mechanisms have been significantly reworked.
The new version makes it easier to view and manage Suricata rules directly from Suri Oculus. Operations for enabling and disabling rules, changing rule actions, and communication between the web client and backend have all been improved.
Particular attention has been paid to making rule operations predictable and reducing the need to manually edit Suricata configuration files.
Local Rules Management
The interface now includes a dedicated Local Rules tab.
Local rules are separated from the main Suricata ruleset and can be managed directly through the Suri Oculus web interface.
This simplifies the development, testing, and maintenance of custom signatures. Users can work with their own rules without mixing them with the main ruleset installed on the system.
New HBF Tab
One of the major additions in Suri Oculus 4.0 is HBF (Host Behavior Fingerprint).
HBF moves the focus from analyzing individual events to analyzing the network activity of a specific device.
Suri Oculus collects information about devices observed on the network and builds an activity profile for each of them. This profile can include IP and MAC addresses, hostname and network interface information, counts for different event types, protocols in use, most active ports, DNS queries, and other characteristics of network behavior.
Instead of working with a large number of isolated Suricata records, HBF provides a more complete picture of how a particular device behaves on the network.
HBF will also serve as a foundation for further development of behavioral analysis capabilities in Suri Oculus.
New daemonmove Capabilities
The daemonmove service, responsible for processing Suricata data and interacting with the storage layer, has also received substantial changes.
As part of the Suri Oculus 4.0 development cycle, its functionality has been extended to support HBF and additional types of collected information.
Service reliability has also been improved, including changes to Redis/Valkey connectivity, service startup handling, and several internal mechanisms.
daemonmove is gradually evolving from an auxiliary event-processing component into one of the key elements of the Suri Oculus backend architecture.
Improved Web Client
A large number of changes have been made to the web interface.
Development has focused not only on adding new functionality, but also on improving the everyday usability of Suri Oculus.
New interface elements and data views have been introduced, information presentation has been refined, light and dark themes have been improved, and the client has been adapted to work with the new backend capabilities.
Special attention has been given to the HBF interface, which needs to present a considerable amount of information about network devices in a compact and readable form.
Changes to oculus-tool
The oculus-tool utility has also been updated.
The tool has been adapted to the changes introduced in Suri Oculus 4.0 and has received a number of internal improvements.
The continued development of oculus-tool remains an important part of the project. It complements the web interface and provides command-line access to administrative and service operations.
Suri Oculus Is Becoming More Than an Event Viewer
Version 4.0 demonstrates the direction in which the project is evolving.
Suri Oculus originally started primarily as a convenient interface for working with Suricata data. Its scope is gradually becoming broader.
Rule management, Local Rules, HBF, the continued development of daemonmove, new search capabilities, and improvements to the analysis tools are turning Suri Oculus into a more comprehensive system for monitoring, analyzing, and investigating network activity with Suricata.
Development of version 4.0 is still in progress. Before the final release, the main focus will be on testing the new functionality, improving the stability of backend components, and completing the remaining interface refinements.
Suri Oculus 4.0 — coming soon.
