> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyberup24.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Recommended Configuration for Deploying the LARK Appliance

Following the recommended deployment configuration helps ensure that your LARK appliance operates reliably, captures traffic accurately, and remains accessible to analysts. The guidance below represents best practices gathered from typical operational deployments. Deviating from these recommendations is possible, but may introduce instability, data loss, or reduced visibility.

<Steps>
  <Step title="Connect power through a UPS">
    Place the LARK appliance on a circuit backed by an uninterruptible power supply (UPS). Unexpected power loss can corrupt in-flight captures and on-disk indexes. A UPS provides ride-through time for a clean shutdown and protects against voltage fluctuations common in field environments.
  </Step>

  <Step title="Connect via a managed switch, not directly to a laptop">
    Use a managed switch as the intermediary between the LARK and any analyst laptops or workstations. Direct laptop-to-appliance connections limit access to a single machine and bypass the switch infrastructure needed for VLAN separation, TAP integration, and multi-analyst access. Connect the appliance's rear connectivity interface to a port on the switch.

    <Note>
      If your deployment includes a dedicated local segment, refer to the [Naming & Addressing](/reference/naming-and-addressing) page for the recommended subnet layout.
    </Note>
  </Step>

  <Step title="Source traffic from a dedicated TAP, not a SPAN port">
    Whenever possible, use a dedicated network TAP on the link you want to monitor rather than a SPAN (mirror) port on a switch. SPAN ports can drop packets under load, merge duplex streams incorrectly, and may not accurately reflect line-rate traffic. A passive TAP provides a lossless, full-duplex copy of the monitored link to the LARK ingress port.

    <Warning>
      If a TAP is not available and a SPAN port must be used, verify that the SPAN configuration mirrors both ingress and egress traffic, and be aware that packet loss is possible under high utilization.
    </Warning>
  </Step>

  <Step title="Place the appliance on a stable, ventilated surface">
    Position the LARK on a surface that is physically stable and allows adequate airflow around the chassis. Do not stack objects on top of the unit or block intake and exhaust vents. In rack deployments, ensure adjacent equipment does not recirculate hot exhaust into the LARK's intake.
  </Step>

  <Step title="Configure periodic data offload">
    Before beginning long-term monitoring, configure the periodic offload or export of captured data to an external destination — such as a NAS, SIEM, or analyst workstation connected through the NIC data export ports. On-appliance storage is finite, and an offload schedule prevents data loss when disk capacity is approached.
  </Step>

  <Step title="Change the default admin credentials immediately">
    After first login, change the default administrative password through the Keycloak admin interface and the system admin panel. Leaving default credentials in place is a significant operational security risk, especially in environments where the LARK is connected to a broader network.

    <Warning>
      Do not defer credential rotation. Default credentials are documented and known. Change them before placing the appliance on any live network segment.
    </Warning>
  </Step>
</Steps>

## Configuration Checklist

Use the following checklist to verify your deployment before going live.

| Item                 | Recommended Practice                                |
| -------------------- | --------------------------------------------------- |
| Power                | Connected through a UPS                             |
| Network connectivity | Via managed switch (rear RJ45 connectivity port)    |
| Traffic source       | Dedicated passive TAP (preferred over SPAN)         |
| Physical placement   | Stable, ventilated surface or rack unit             |
| Data offload         | Periodic export scheduled to external destination   |
| Admin credentials    | Default credentials changed on first login          |
| Delivery record      | On file and accessible for model-specific reference |