Skip to main content
Every LARK is delivered with a standard set of applications installed and configured. Together they cover the full path that data takes through the appliance, from capturing traffic through storing it, making it queryable, and applying AI. These applications are present on every appliance regardless of model.
This page covers the applications installed by default. Additional approved applications may also be added; those are described on the optional software page. The procedures for installing and removing applications are in the administration section.

​
Default applications

​
Roles

The default applications map onto the layered flow described on the architecture overview page:
These sensors act on traffic as it arrives at the TAP Ingress Port. Suricata performs signature-based intrusion detection and captures full packet data. Zeek analyzes the same traffic to produce detailed protocol logs and extracts files from it. Strelka receives the files Zeek extracts and analyzes them.
The data the sensors produce is stored on the appliance. ClickHouse holds structured, indexed data such as logs and telemetry and supports fast querying. MinIO provides object storage for large, unstructured data such as packet captures and extracted files.
vLLM is the inference engine that runs large language models locally on the appliance. OpenWebUI is the interface through which analysts interact with that local AI for summarization and investigative assistance. All inference occurs on the appliance.
These applications operate the appliance itself rather than acting on captured data. Keycloak provides identity and single sign-on across all applications. Rancher is the control plane used to deploy, monitor, and manage the containerized applications.
Access to every application is routed through single sign-on, so operators authenticate once and then reach the applications their role permits. Identity and access are covered on the identity and access management page.