FAQ
Do I need Kafka?
Section titled “Do I need Kafka?”No. You can process EVE files with suricatavel read-eve, or have Suricatavel listen directly from Suricata (if installed on the same machine) with suricatavel:listen-socket.
However, Kafka is the recommended option in production, for continuous and robust ingestion.
How do I schedule tasks?
Section titled “How do I schedule tasks?”Configure Laravel’s cron to run the scheduler. See the “Scheduled Tasks” section.
How do I add rules?
Section titled “How do I add rules?”Use feeds (suricatavel rules fetch) or load your rules into the database and deploy with suricatavel rules deploy.