Squert is a web application that is used to query and view event data stored in a Sguil database (typically IDS alert data). Squert is a visual tool that attempts to provide additional context to events through the use of metadata, time series representations and weighted and logically grouped result sets. The hope is that these views will prompt questions that otherwise may not have been asked.

Demo / I
nstructions / Download
:
 https://github.com/int13h/squert


Current Version: 1.3.0


Added Elasticsearch capability (so I could query my Bro logs):

depending on where you are within the interface the terms and interval will differ


the data will be placed either at the root (if you aren't pinned to anything) or appended to your current context


The queries are presently very simple; but still quite powerful. I have a bit of work to do here yet but it is functional. I will put together a short video when I have a little more time. This external lookup feature will be generalized eventually, this is just the first kick at bringing in complimentary data.


Added support for sguils new autocat functionality:

this is handy as hell and will be especially helpful for first timers



Added bar overlays to the summary tables:



Added a few more options for the Sankey diagrams; added country flags to the nodes:



Interface cleanup

I have been reading Tufte's books on design and have been trying to adopt suggestions from the books. I have removed a lot of the dark colouring, stark field separators and shifted focus to the actual data not the descriptors. The timepicker is now hidden by default and can be toggled by clicking the interval link.

Progress I hope :)

Elasticsearch

I have bundled the official Elasticsearch client for php and I hope it will just work for you. Take a look at the basic parameter settings that are in .inc/config.php.sample. If you are having problems try here. If you have logs in ES all you should need to do is edit the "type" fields in .js/squertFunctions.js.

I will make this easier when I have some time.