domains / families / security / suricata-offline-evejson

suricata-offline-evejson

separate

Running Suricata against PCAPs offline and validating results via eve.json

When to use

• Running Suricata on PCAPs offline
• Validating results via eve.json
• Inspecting alerts in EVE JSON
• Validating rule syntax
• Testing positive and negative PCAPs

Skill page

Source