> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyberup24.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Applications

Every LARK is delivered with a standard set of applications installed and configured. Together they cover the full path that data takes through the appliance, from capturing traffic through storing it, making it queryable, and applying AI. These applications are present on every appliance regardless of model.

<Note>
  This page covers the applications installed by default. Additional approved applications may also be added; those are described on the optional software page. The procedures for installing and removing applications are in the administration section.
</Note>

## Default applications

| Application | Purpose                                      | Role in the flow |
| ----------- | -------------------------------------------- | ---------------- |
| Suricata    | Intrusion detection and packet capture       | Collection       |
| Zeek        | Network traffic analysis and file extraction | Collection       |
| Strelka     | File analysis                                | Collection       |
| ClickHouse  | Structured data storage and querying         | Data processing  |
| MinIO       | Object storage for large files and artifacts | Data processing  |
| vLLM        | Local large language model inference         | AI               |
| OpenWebUI   | Analyst interface for the local AI           | AI               |
| Keycloak    | Identity and single sign-on                  | Platform         |
| Rancher     | Container orchestration and management       | Platform         |

## Roles

The default applications map onto the layered flow described on the architecture overview page:

<AccordionGroup>
  <Accordion title="Collection: Suricata, Zeek, Strelka">
    These sensors act on traffic as it arrives at the TAP Ingress Port. Suricata performs signature-based intrusion detection and captures full packet data. Zeek analyzes the same traffic to produce detailed protocol logs and extracts files from it. Strelka receives the files Zeek extracts and analyzes them.
  </Accordion>

  <Accordion title="Data processing: ClickHouse, MinIO">
    The data the sensors produce is stored on the appliance. ClickHouse holds structured, indexed data such as logs and telemetry and supports fast querying. MinIO provides object storage for large, unstructured data such as packet captures and extracted files.
  </Accordion>

  <Accordion title="AI: vLLM, OpenWebUI">
    vLLM is the inference engine that runs large language models locally on the appliance. OpenWebUI is the interface through which analysts interact with that local AI for summarization and investigative assistance. All inference occurs on the appliance.
  </Accordion>

  <Accordion title="Platform: Keycloak, Rancher">
    These applications operate the appliance itself rather than acting on captured data. Keycloak provides identity and single sign-on across all applications. Rancher is the control plane used to deploy, monitor, and manage the containerized applications.
  </Accordion>
</AccordionGroup>

<Tip>
  Access to every application is routed through single sign-on, so operators authenticate once and then reach the applications their role permits. Identity and access are covered on the identity and access management page.
</Tip>