Skip to main content
LARK software updates are applied through the admin interface. When an update is available — whether it contains new detection content, protocol decoder improvements, AI model refreshes, or security fixes — the process is straightforward and does not require physical access to the appliance. Plan updates for maintenance windows when a brief service interruption is acceptable, and always verify that the appliance has returned to normal operation after the update completes.

​
How Updates Are Delivered

The LARK does not automatically download or apply updates. Updates are software packages that you retrieve and apply through the admin interface when you are ready. This gives you control over when updates are applied and allows you to review what changed before committing.
The LARK must have network connectivity to the update source to check for and retrieve updates. If your deployment restricts outbound network access, ensure that the update endpoint is reachable from the management interface before attempting an update.

​
Applying an Update

1

Navigate to System Updates

In the admin interface, go to System → Updates. This panel shows the currently installed version, the last time an update check was performed, and any available updates that have already been retrieved.
2

Check for available updates

Select Check for Updates. The LARK contacts the update source and lists any available packages. Each entry shows the version number, release date, and a summary of what is included in the update.
3

Review the update contents

Read the release notes for each available update before proceeding. Pay attention to any notes about changes to default behavior, detection rule set changes, or post-update configuration steps that may be required.
4

Apply the update

Select the update you want to apply and choose Apply Update. The admin interface will ask you to confirm before proceeding. Confirm to begin the update process.
5

Wait for services to restart

The LARK downloads the update package, stops the affected services, replaces them with the updated version, and restarts them. The admin interface displays progress. Depending on the size of the update and network conditions, this process typically takes a few minutes.
6

Verify successful completion

Once the update completes, the admin interface returns to normal and displays the new version number under System → Updates. Check the Service Status panel to confirm that all services have restarted successfully and are reporting healthy.

​
What to Expect During an Update

While the LARK is applying an update, you should expect the following:

Brief Service Interruption

Services that are being updated will stop briefly while the updated version is started in their place. During this window, active data capture and processing pauses for affected services. The duration of the interruption is typically short — on the order of seconds to a minute — but depends on the scope of the update.

Admin Interface Availability

The admin interface itself may briefly become unavailable if the update includes changes to the interface service. If the interface becomes unreachable during an update, wait a minute and reload — it will return once the updated service has started.
In-progress data writes may be interrupted during a service restart. The LARK is designed to recover gracefully from this, but data captured in the seconds immediately before a service restart may not be fully committed to storage. For this reason, applying updates during periods of active incident response is not recommended.

​
After the Update

After a successful update, confirm the following before returning the appliance to normal operation:
  • All services show a healthy status in System → Service Status
  • Data capture is actively running (check the traffic statistics on the dashboard)
  • Any offload jobs that were in progress before the update have completed or resumed
  • The updated version number is reflected in System → Updates
Apply updates during planned maintenance windows when you can briefly tolerate a pause in data capture. In most deployments, the interruption is short enough that the impact on detection coverage is negligible — but scheduling updates outside of known high-activity periods is a good practice.

​
Update Frequency

There is no required update cadence, but applying updates regularly keeps your detection content current and ensures you benefit from platform improvements and security fixes. Check for updates at least monthly, and apply security-relevant updates promptly when they are released.