Skip to main content
The LARK runs its entire software stack as containerized services managed by a Kubernetes-based orchestration layer. On SWIFT and PEREGRINE these services run on a single server; on APEX they run across multiple nodes. In both cases the appliance presents the same set of capabilities and operates identically.

​
Design principles

The architecture is built on a consistent set of principles:

Local operation

All services run on the appliance itself. No external compute or cloud connectivity is required for normal operation, so the appliance can operate in isolated or air-gapped environments provided a traffic source reaches the TAP Ingress Port.

Component isolation

Each service runs in its own container with enforced resource boundaries, so no single workload can starve the others, and services can be added, updated, or removed without disturbing the rest of the system.

Automation over configuration

Internal functions such as networking, data processing, and storage are handled automatically. The appliance is designed to require minimal manual configuration.

Passive monitoring

The appliance monitors a copy of network traffic and never sits inline, allowing continuous observation without affecting the monitored network.

​
Layered model

The architecture is organized as a layered model, in which each layer performs its function and passes data to the next:
  1. Network traffic enters through the collection layer, where sensors convert raw packets into structured telemetry.
  2. That telemetry is enriched and stored by the data processing layer.
  3. The visualization layer provides the tools used to query, correlate, and investigate the stored data.
  4. An AI automation layer supports summarization, natural-language investigation, and workflow automation across the collected data.
Each layer operates independently while feeding the next. The architecture layers page describes each layer in detail.
The layers describe how data moves through the system. They are not separate machines; all layers run together on the same appliance.

​
Stack management

The software stack is delivered as containerized applications and managed through Rancher, the control plane used to deploy, monitor, and maintain services on the appliance. A defined set of applications is installed by default, and administrators may add others from an approved on-appliance source as requirements evolve. The default set is covered on the applications page, additional options on the optional software page, and the procedures for installing and removing applications in the administration section.