Skip to main content
The Lightweight AI Reconnaissance Kit (LARK) is a self-contained cybersecurity platform that gives your team full visibility into network activity from the moment it is powered on. It captures network traffic passively, detects threats, retains full packet data, and supports AI-assisted analysis — all running locally on the appliance, with no cloud connectivity required.

Overview

Learn what the LARK is, what it does, and how it fits into your network.

Kit Composition

Understand the hardware, components, and interfaces that make up a LARK kit.

Setup

Step-by-step instructions for getting your LARK running on your network.

Quick Start

Condensed steps to go from unboxing to active monitoring as fast as possible.

​
What the LARK does

The LARK observes network traffic passively using a TAP or switch SPAN port, then turns that traffic into structured telemetry, alerts, and retained packet data — all accessible through a browser on any connected laptop.

Architecture

How the software stack, services, and data flows are organized.

Administration

Managing users, applications, and system health on a running appliance.

Data Management

How collected data is stored, processed, and offloaded to external destinations.

Troubleshooting

Diagnose and resolve common issues with the LARK appliance.

​
LARK models

The LARK is available in three models — SWIFT, PEREGRINE, and APEX — all running the same software. They differ in compute, storage, and the number of nodes.

Models & Capacity

Compare SWIFT, PEREGRINE, and APEX hardware specifications and capacity.
If you are setting up a LARK for the first time, start with the Kit Composition and Setup sections. If the appliance is already running, jump to Administration or Data Management.