SO-CRATES

Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus

A standalone web application for analyzing pcap files, log files, email messages, and binary files. Features include Suricata network analysis (with tshark adding the protocols Suricata doesn't parse), YARA binary scanning, Sigma rule detection for logs, email header/link/attachment analysis, and a single-page UI for browsing alerts, metadata, transcripts, and hexdumps.

📖 Full documentation: https://so-crates.org/

Documentation

• Interactive Demo
• Installation (OhMyDebn, Docker, Podman)
• Usage
• Themes
• Configuration
• Security
• Architecture / API Reference / Filtering
• Credits
• Release Notes

Development

See AGENTS.md for agent-focused guidance on maintaining SO-CRATES, including updating vendored dependencies.

# All tests
python3 -m unittest discover -v

License

See LICENSE.