> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyberup24.com/llms.txt
> Use this file to discover all available pages before exploring further.

# System Updates

LARK software updates are applied through the admin interface. When an update is available — whether it contains new detection content, protocol decoder improvements, AI model refreshes, or security fixes — the process is straightforward and does not require physical access to the appliance. Plan updates for maintenance windows when a brief service interruption is acceptable, and always verify that the appliance has returned to normal operation after the update completes.

## How Updates Are Delivered

The LARK does not automatically download or apply updates. Updates are software packages that you retrieve and apply through the admin interface when you are ready. This gives you control over when updates are applied and allows you to review what changed before committing.

<Note>
  The LARK must have network connectivity to the update source to check for and retrieve updates. If your deployment restricts outbound network access, ensure that the update endpoint is reachable from the management interface before attempting an update.
</Note>

## Applying an Update

<Steps>
  <Step title="Navigate to System Updates">
    In the admin interface, go to **System → Updates**. This panel shows the currently installed version, the last time an update check was performed, and any available updates that have already been retrieved.
  </Step>

  <Step title="Check for available updates">
    Select **Check for Updates**. The LARK contacts the update source and lists any available packages. Each entry shows the version number, release date, and a summary of what is included in the update.
  </Step>

  <Step title="Review the update contents">
    Read the release notes for each available update before proceeding. Pay attention to any notes about changes to default behavior, detection rule set changes, or post-update configuration steps that may be required.
  </Step>

  <Step title="Apply the update">
    Select the update you want to apply and choose **Apply Update**. The admin interface will ask you to confirm before proceeding. Confirm to begin the update process.
  </Step>

  <Step title="Wait for services to restart">
    The LARK downloads the update package, stops the affected services, replaces them with the updated version, and restarts them. The admin interface displays progress. Depending on the size of the update and network conditions, this process typically takes a few minutes.
  </Step>

  <Step title="Verify successful completion">
    Once the update completes, the admin interface returns to normal and displays the new version number under **System → Updates**. Check the **Service Status** panel to confirm that all services have restarted successfully and are reporting healthy.
  </Step>
</Steps>

## What to Expect During an Update

While the LARK is applying an update, you should expect the following:

<CardGroup cols={2}>
  <Card title="Brief Service Interruption" icon="clock-rotate-left">
    Services that are being updated will stop briefly while the updated version is started in their place. During this window, active data capture and processing pauses for affected services. The duration of the interruption is typically short — on the order of seconds to a minute — but depends on the scope of the update.
  </Card>

  <Card title="Admin Interface Availability" icon="display">
    The admin interface itself may briefly become unavailable if the update includes changes to the interface service. If the interface becomes unreachable during an update, wait a minute and reload — it will return once the updated service has started.
  </Card>
</CardGroup>

<Warning>
  In-progress data writes may be interrupted during a service restart. The LARK is designed to recover gracefully from this, but data captured in the seconds immediately before a service restart may not be fully committed to storage. For this reason, applying updates during periods of active incident response is not recommended.
</Warning>

## After the Update

After a successful update, confirm the following before returning the appliance to normal operation:

* All services show a healthy status in **System → Service Status**
* Data capture is actively running (check the traffic statistics on the dashboard)
* Any offload jobs that were in progress before the update have completed or resumed
* The updated version number is reflected in **System → Updates**

<Tip>
  Apply updates during planned maintenance windows when you can briefly tolerate a pause in data capture. In most deployments, the interruption is short enough that the impact on detection coverage is negligible — but scheduling updates outside of known high-activity periods is a good practice.
</Tip>

## Update Frequency

There is no required update cadence, but applying updates regularly keeps your detection content current and ensures you benefit from platform improvements and security fixes. Check for updates at least monthly, and apply security-relevant updates promptly when they are released.