Skip to main content

Purpose

This documentation provides technical and operational guidance for the Lightweight AI Reconnaissance Kit (LARK). It is intended for the personnel who set up, operate, administer, and maintain the appliance: analysts working with the collected data, and administrators responsible for user access, applications, and system health. The documentation provides the information required to deploy a LARK on a network, understand its operation, use its tools effectively, and resolve common issues, without assuming prior familiarity with the underlying container platform.

Scope

This documentation covers the LARK appliance as a standalone system, including its hardware, its software stack, and the procedures for setup, administration, data management, maintenance, and troubleshooting. It applies to all three models (SWIFT, PEREGRINE, and APEX). The models share the same software and operating procedures, and the guidance applies to every model except where a page identifies a specific difference. The following are outside the scope of this documentation:
  • Network configuration. The configuration of the TAP, SPAN/mirror port, or switch that supplies traffic to the appliance is specific to each environment. This documentation describes the traffic the appliance expects to receive and how it is connected, but the design of the monitored network is the responsibility of the operating organization.
  • Offload destinations. The LARK can export collected data to external storage or analytics systems. Those systems are external to the appliance and are not covered here.
  • Optional software. The appliance ships with a defined set of applications. Additional approved applications may be installed, and the procedure for doing so is documented, but individual third-party tools are not.

Organization

The documentation follows the progression of working with a LARK. It begins with this introduction and an overview of the models, proceeds through kit composition, system architecture, and setup, and continues through administration and data management. It concludes with maintenance and troubleshooting. Reference material, including port pinouts, application URLs, and naming and addressing conventions, is collected in the reference section.
For an initial setup, begin with the kit composition and setup sections. For administration of an operational appliance, the administration and data management sections are most relevant.