<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1492362408763_16377">Hi,</div><div id="yui_3_16_0_ym19_1_1492362408763_16382"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1492362408763_16383">I've been struggling to get suricata alerts appear in Sguil. I've tried many different types of configurations to no avail. Here's the <br></div><div id="yui_3_16_0_ym19_1_1492362408763_16404" dir="ltr">command I utilize:</div><div id="yui_3_16_0_ym19_1_1492362408763_16411" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1492362408763_16453" dir="ltr">suricata -c /etc/nsm/pching-VM-eth1/suricata.yaml -r inside.tcpdump -F /etc/nsm/pching-VM-eth1/bpf-ids.conf</div><div id="yui_3_16_0_ym19_1_1492362408763_16521" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1492362408763_16520" dir="ltr">The inside.tcpdump is a pcap file. I've also attached my suricata.yaml.</div><div id="yui_3_16_0_ym19_1_1492362408763_16519" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1492362408763_16518" dir="ltr">Thank you, in advance, for your help,</div><div id="yui_3_16_0_ym19_1_1492362408763_16517" dir="ltr">John<br></div><div id="yui_3_16_0_ym19_1_1492362408763_16462" dir="ltr"><br></div></div></body></html>