Suricata Log Parser

A simple log parser for Suricata log file (JSON)

About

This tool basically interpret Suricata IDS log files (JSON format) into more human-friendly and beautiful format.

This is just a layman's coding style. Create this just for fun and for learning purpose.

Main Function

This analyzer will convert the Suricata JSON file that submitted and display the result in the next page.

The result will contains:

• Source IP
• Source Port
• Destination IP
• Destination Port
• IDS Signature
• Hostname
• URL

Example output:

Log Parser in action:

How to use

1. Clone this suricatalogparser to your computers/servers
2. Put the folder on your html root folder. E.g. /var/www/html/
3. Make sure all files are owned by the Apache group and user. In Ubuntu, it is the www-data group and user
> $ sudo chown -R www-data:www-data /var/www/html/suricatalogparser
4. Enabled all members of the www-data group to read and write files
> $ sudo chmod -R g+rw /var/www/html/suricatalogparser
5. Visit http://127.0.0.1/suricatalogparser via web browser
6. Upload you JSON file that you got from Suricata IDS. Mostly the filename is "eve.json".
7. Profit! :)

Any feedback are welcomed. You can contact me via email at m[d0t]khairulazam@gmail[d0t]com.

Credit : Suricata for the logo :)