Skip to main content
Data moves through the LARK as a continuous pipeline. Traffic arrives at the TAP Ingress Port, sensors convert it into structured data, that data is stored on the appliance, and analysts and AI operate against it. This runs continuously while the appliance is powered on, with no action required to sustain it.

​
The default pipeline

With the default applications, data flows through the following stages:
1

Traffic arrives

A copy of network traffic reaches the TAP Ingress Port from a TAP or a switch SPAN (mirror) port.
2

Sensors process the traffic

Suricata performs signature-based detection, generating alerts for matched rules, and captures full packet data. Concurrently, Zeek analyzes the same traffic to produce structured protocol logs and extracts files from it.
3

Files are analyzed

Strelka receives the files Zeek extracts and analyzes them, producing structured results.
4

Data is stored

Full packet captures and extracted files are written to MinIO object storage. Structured logs, alerts, and analysis results are written to ClickHouse, where they can be queried quickly.
At this point all captured data is stored on the appliance and available for querying, visualization, and AI-assisted analysis. This is the complete default path: nothing beyond the default applications is required for the appliance to capture, process, store, and make data available.

​
Optional enhancement stage

When the optional correlation and automation applications are installed, they add a stage on top of the default pipeline:
1

Correlation and search (RunReveal, optional)

When RunReveal is present, the logs and alerts produced by the sensors are also forwarded to it. RunReveal normalizes, indexes, and correlates the incoming data, runs detection rules, and generates correlated alerts, providing a central point for search and correlation.
2

Automated workflows (Tracecat, optional)

When Tracecat is present, alerts can trigger automated workflows that carry out response actions such as creating tickets, sending notifications, and collecting evidence.
RunReveal and Tracecat are optional and may not be installed on a given appliance. Without them, the default pipeline still captures, processes, and stores all data; these applications add correlation, search, and automation. The optional software page provides details.