Working with HBF in Suri Oculus 4.0

The HBF tab is designed for viewing devices detected by Suri Oculus in monitored networks and analyzing their network activity.

HBF builds a profile for each observed device based on Suricata events and additional device information. This makes it possible to move from examining individual network events to analyzing the behavior of a specific host.

The following information may be available for a device:

• IP address;

• MAC address;

• hostname;

• network interface;

• first and last observation times;

• total number of network events;

• Flow, Alert, DNS, TLS, and HTTP statistics;

• TCP, UDP, and ICMP statistics;

• most frequently used destination ports;

• most frequently requested DNS domains;

• most frequently observed TLS SNI values;

• most frequently contacted remote IP addresses.

HBF therefore provides a compact behavioral profile of a device without requiring manual analysis of a large number of individual Suricata events.

1. Displaying the Device List #

To retrieve the list of known HBF devices, click:

Show Devices

Suri Oculus loads the device list from the HBF data stored in Redis.

The devices are then displayed in a table.

The main table contains:

If an IP address belongs to the Suri Oculus system itself, it is additionally marked as:

192.168.100.2 — SURI OCULUS

This makes it possible to distinguish the Suri Oculus server from other network devices without excluding it from HBF monitoring.

2. First Seen and Last Seen #

For each device, HBF stores the time of its first and most recent observation.

First Seen shows when the device was first registered by HBF.

Last Seen shows the time of the most recent event associated with the device.

For example:

First Seen: 9/28/2026, 10:15:42
Last Seen:  9/30/2026, 14:37:18

These values help determine how long the device has been known to the system and how recently it has shown network activity.

Devices that are no longer observed may remain in HBF for the period defined by:

hbf_device_retention_days

For example:

hbf_device_retention_days = 7;

means that information about an inactive device may be retained in HBF for seven days.

3. Sorting the Device List #

The HBF table supports sorting.

To change the order, click the corresponding column header.

Devices can be sorted by:

• IP Address;

• First Seen;

• Last Seen;

• Events.

Clicking the same column header again reverses the sort direction.

The direction is indicated by:

▲
▼

By default, devices are sorted by Last Seen in descending order, so the most recently observed devices appear at the top of the list.

IPv4 addresses are sorted using their numeric representation rather than simple lexicographical string comparison.

4. Searching for a Device by IP Address #

The:

Enter IP

field and:

Search by IP

button are used to filter the loaded device list.

For example:

192.168.100.25

The search is not limited to complete IP addresses.

A partial address can also be used:

192.168

or:

192.168.100

or another part of an address:

100.142

HBF displays devices whose IP addresses contain the specified sequence.

This is useful for quickly viewing devices from a particular subnet or address group.

Important: the search is performed against the already loaded device list. Therefore, click Show Devices before performing a search.

5. Navigating the Device List #

If the number of devices exceeds the selected page size, the list is divided into multiple pages.

Use:

Previous — to move to the previous page.

Next — to move to the next page.

The current position is displayed in the following format:

2 / 5

where the first number is the current page and the second number is the total number of pages.

The number of devices displayed per page can be selected from:

10
20
30

The default value is:

20

devices per page.

Pagination is performed on the client side after the device list has been loaded.

6. Selecting a Device #

To open detailed information about a device, click its row in the table.

The selected row is visually highlighted, and Suri Oculus requests the complete HBF profile for the selected IP address.

The device profile contains more detailed information than the main device table.

It consists of several logical sections:

Device
   |
   +-- Identity
   |
   +-- Activity Summary
   |
   +-- Top Destination Ports
   |
   +-- Top DNS Domains
   |
   +-- Top TLS Services
   |
   +-- Top Remote IP Addresses

7. Device Profile Header #

At the top of the profile, Suri Oculus displays:

Device <IP address>

For example:

Device 192.168.100.25

If additional device information is available, the following values may be displayed below the IP address:

hostname · interface · MAC

For example:

workstation-01   ·   enp2s0   ·   00:11:22:33:44:55

If identity information is not available, the interface displays:

Identity information is unavailable

8. Identity #

The Identity section contains information that can be used to identify the device.

The following fields are displayed:

Not all fields are necessarily available for every device.

For example, a device may be observed by Suricata while current ARP information for that device is unavailable.

Unknown values are displayed as:

-

9. ARP Status #

HBF uses ARP information to provide additional identification of devices on the local network.

The device profile header may display one of the following states:

ARP detected
ARP known
ARP unavailable

ARP detected means that current ARP information is available for the device.

ARP known means that ARP information about the device is known to the system, although it may not belong to the current observation.

ARP unavailable means that no ARP information is available for the device.

ARP is used as an additional source of device identity information and is not required for a device to appear in HBF.

10. Activity Summary #

The Activity Summary section provides aggregated statistics about the device’s network activity.

It displays:

Total
Flows
Alerts
DNS
TLS
HTTP
TCP
UDP
ICMP

Total #

The total number of events associated with the device.

Flows #

The number of Suricata flow events.

Alerts #

The number of alert events.

A high value does not by itself mean that the device is malicious. It represents the number of Alert events associated with the IP address.

DNS #

The number of observed DNS events.

TLS #

The number of TLS events.

HTTP #

The number of HTTP events.

TCP #

The number of events associated with TCP.

UDP #

The number of events associated with UDP.

ICMP #

The number of events associated with ICMP.

The Activity Summary also contains:

First Seen
Last Seen

which makes it possible to compare the volume of device activity with the period during which it has been observed.

11. Top Destination Ports #

The:

Top Destination Ports

section displays the destination ports most frequently observed in the device’s flow events.

The table contains:

Port is the destination port number.

Flow Events is the number of flow events in which that port was observed.

This information helps provide a quick indication of the device’s network activity.

For example, a large number of connections to:

443

typically indicates active use of HTTPS/TLS services.

When interpreting non-standard ports, consider the purpose of the device and the applications running on it.

If no port information is available, the interface displays:

No destination ports observed.

12. Top DNS Domains #

The:

Top DNS Domains

section displays the domain names most frequently observed in the device’s DNS activity.

The table contains:

Domain is the requested domain name.

DNS Requests is the number of recorded DNS requests.

This section can be used to analyze which Internet services the device communicates with.

It can also help identify unusual DNS activity. However, frequent requests to a particular domain do not by themselves indicate an attack or compromise.

If no DNS information is available, the interface displays:

No DNS domains observed.

13. Top TLS Services #

The:

Top TLS Services

section displays the most frequently observed TLS SNI values.

SNI — Server Name Indication — can identify the service name used when establishing a TLS connection, provided that this information is available in the observed TLS handshake.

The table contains:

TLS SNI is the server name obtained from TLS SNI.

TLS Events is the number of corresponding TLS events.

This section complements DNS statistics and helps provide a clearer picture of the external TLS services used by the device.

If no SNI values were observed, the interface displays:

No TLS SNI values observed.

14. Top Remote IP Addresses #

The:

Top Remote IP Addresses

section displays the remote IPv4 addresses most frequently observed in flow events associated with the selected device.

The table contains:

Remote IP is the address of another host participating in network communication with the device.

Flow Events is the number of flow events associated with that address.

This section provides a quick view of the device’s primary network relationships.

Together with:

Top Destination Ports
Top DNS Domains
Top TLS Services

it provides a more complete picture of the host’s network behavior.

If no remote IP addresses were observed, the interface displays:

No remote IPv4 addresses observed.

15. Information Sources #

HBF can combine information from multiple sources.

In the basic device representation, the following sources may be indicated:

ARP
Suricata

Suricata provides information about the device’s network activity.

ARP provides additional information used to identify devices on the local network, including MAC addresses and related data.

This allows HBF to associate network behavior with a more meaningful identity of a particular host.

16. The Suri Oculus Server in HBF #

The server running Suri Oculus is not excluded from HBF.

If its IP address appears in network events, it is displayed in the device list in the same way as other hosts.

The backend identifies the local IPv4 addresses of the server and marks matching HBF devices with the name:

SURI OCULUS

In the device table, this appears, for example, as:

192.168.100.2 — SURI OCULUS

This is particularly important for systems with multiple network interfaces.

For example, a server may simultaneously have the addresses:

192.168.100.2
192.168.122.196

Both addresses may appear in HBF if the corresponding activity is observed by Suricata.

This approach avoids excluding the Suri Oculus server’s own network activity from analysis while still making it easy to distinguish the server from other devices.

17. Clear Fields #

The:

Clear Fields

button clears the current state of the HBF tab.

The operation:

• clears the search field;

• removes the loaded device list;

• clears the selected device;

• clears the device profile;

• resets the current page to 1;

• resets the page size to 20;

• restores sorting to Last Seen in descending order.

After clearing the tab, click:

Show Devices

again to reload the device data.

18. Interpreting an HBF Profile #

HBF should be considered an aggregated representation of device network behavior rather than an independent mechanism for determining whether a device is malicious.

For example, a profile such as:

Total Events       12500
Flows               8200
Alerts                12
DNS                  940
TLS                 2100
HTTP                 320

combined with:

Top Destination Ports
443
53
80

and known DNS/TLS services may represent an ordinary workstation.

Another profile may show a large number of connections to unusual destination ports and many different remote IP addresses.

Such behavior may justify further investigation, but it is not by itself proof of malicious activity.

HBF is therefore most useful for quickly answering questions such as:

What device is this?
When was it first observed?
When was it last active?
How active is it?
Which protocols does it use?
Which destination ports does it contact?
Which DNS names does it request?
Which TLS services does it communicate with?
Which remote IP addresses does it contact?

19. Recommended Device Analysis Workflow #

For an initial investigation of a device, the following workflow can be used:

1. Find the device by IP address.

2. Check First Seen and Last Seen.

3. Check MAC Address, Hostname, and Interface.

4. Check the ARP status.

5. Review the Activity Summary.

6. Check the number of Alerts.

7. Review Top Destination Ports.

8. Review Top DNS Domains.

9. Review Top TLS Services.

10. Review Top Remote IP Addresses.

11. If unusual activity is detected, continue with analysis of the corresponding Suricata events.

This workflow makes it possible to move quickly from a general view of the device’s behavior to specific events that require deeper investigation.

20. Summary #

The HBF tab provides a device-oriented view of network activity.

The main workflow is:

Show Devices
      |
      v
Device List
      |
      +-- Search by IP
      |
      +-- Sort
      |
      +-- Pagination
      |
      v
Select Device
      |
      v
Device Profile
      |
      +-- Identity
      +-- Activity Summary
      +-- Top Destination Ports
      +-- Top DNS Domains
      +-- Top TLS Services
      +-- Top Remote IP Addresses

Instead of examining individual events, the user receives an aggregated device profile combining identity information, activity statistics, protocol usage, and primary network relationships.

HBF does not replace the analysis of Suricata events and alerts. Its purpose is to provide a higher-level representation of the collected data and help identify which devices and which aspects of their network behavior require further investigation.