Skip to main content
Stellar Alert & Case Relay is a lightweight Python daemon for organizations that already operate a SIEM or SOC portal and want Stellar Cyber detections delivered directly into those existing workflows.
The runtime script and CLI retain the historical Syslog naming, but the documented wire format is newline-delimited JSON (NDJSON) over TCP.

​
Why it exists

On-prem SOC teams often already have established SIEM dashboards, monitoring portals, and operational processes. They still need Stellar Cyber NDR/XDR alerts and cases inside those systems without manual exports or one-off integrations.

​
What it does

Alert and case forwarding

Pulls alerts and cases from the Stellar Cyber API and forwards them to downstream SOC systems.

Flexible stream modes

Run alert-only, case-only, or both streams from the same daemon.

Built for operations

Supports fetch checkpointing, send retry/recovery, and backfill for continuous operation.

Separate destinations

Alert and case streams can use independent destination IP addresses and ports.

​
At a glance

​
Typical deployment

The relay runs on a Linux host that can reach both Stellar Cyber and the destination SIEM/SOC receiver. For long-running deployments, run it under systemd so it starts at boot and automatically recovers from process failures.

Quickstart

Start an alert stream, a case stream, or both.

Configuration

Configure stream intervals, destinations, and case options.

Run with systemd

Keep the relay running continuously and inspect service logs.

Output format

Prepare your receiver for TCP NDJSON delivery.