Suricata Offline Mode + EVE JSON

This skill covers running Suricata against PCAPs offline and validating results via eve.json.

Run Suricata on a PCAP

Typical offline invocation:

suricata -c /root/suricata.yaml -S /root/local.rules -k none -r /root/sample.pcap -l /tmp/suri

Flags:

• -r <pcap>: replay a PCAP offline
• -S <rules>: load only the specified rules file
• -l <dir>: log directory (will contain eve.json)
• -k none: ignore checksum issues

Inspect alerts in EVE JSON

Count alerts: