Skip to main content
The LARK is organized into functional layers that follow the path data takes through the appliance. The layers describe how the system behaves; they are not separate machines, and all layers run together on the appliance simultaneously. Data moves through four layers in sequence: it is collected, then processed and stored, then made available for visualization and analysis, with an AI automation layer available across the collected data. The default applications carry each layer independently. Optional applications, where present, augment the visualization and AI layers.

​
Collection layer

The collection layer ingests network traffic and converts it into structured telemetry. Traffic arrives at the TAP Ingress Port as a copy delivered from a TAP or a switch SPAN (mirror) port. Three default sensors act on it:
  • Suricata performs signature-based intrusion detection and captures full packet data, generating alerts and recording activity for later analysis.
  • Zeek analyzes the same traffic to produce detailed protocol logs and extracts files from the traffic.
  • Strelka receives the files Zeek extracts and analyzes them.

​
Data processing layer

The data processing layer converts raw sensor output into structured, stored data. The output of the collection layer is enriched and written to storage. Two default applications handle storage:
  • MinIO provides object storage for large, unstructured data such as packet captures and extracted files.
  • ClickHouse provides structured storage for indexed logs and telemetry and supports fast querying.
This occurs automatically. No action is required to manage data pipelines or storage.

​
Visualization and analysis layer

This layer provides the tools used to query, correlate, and investigate the stored data. By default, the stored data is directly queryable through the appliance’s tools. Optional applications add richer analysis:
When installed, RunReveal aggregates logs and alerts, correlates them, and applies detection rules, serving as the central point for searching collected data.
When installed, Grafana provides dashboards for visualizing the appliance’s data, supporting the identification of patterns and the monitoring of activity over time.
When installed, Nessus adds active vulnerability scanning against hosts on a network, complementing the passive monitoring the appliance performs by default.
The applications in this layer beyond the default query tools are optional and may not be present on a given appliance. The optional software page provides details.

​
AI automation layer

The AI automation layer supports summarization, natural-language investigation, and workflow automation across the collected data. AI runs entirely on the appliance:
  • vLLM is the inference engine that runs large language models locally.
  • OpenWebUI is the analyst interface for interacting with that local AI.
Together these support natural-language analysis, summarization, and investigative assistance across collected data, with all inference occurring on the appliance and no external connectivity required.
When installed, Tracecat adds automation workflows and case management, including AI agents that run inside workflows for investigation, enrichment, and response. It ships preconfigured to begin working with collected data soon after startup, and analysts can extend it with custom workflows and agents.