Skip to main content

Alert & Case integration

​
Move Stellar Cyber alerts and cases into the workflows you already run.

Stellar Relay polls the Stellar Cyber API, keeps durable queue and checkpoint state in SQLite, and forwards enabled Alert and Case streams as NDJSON over TCP.

Start the relay →Review output format
PollRead Alert and Case streams independently from the Stellar Cyber API.
QueueKeep checkpoints and pending delivery state locally for recovery.
ForwardDeliver newline-delimited JSON over TCP into existing SIEM/SOC workflows.
Some legacy option names contain “syslog”, but the payload is newline-delimited JSON, not RFC 5424 syslog.

​
How it works

Alert and Case streams are independent. Run Alert only, Case only, or both.

​
Start here

Quickstart

Run the interactive wizard and optionally install the systemd service.

Configuration

Review CLI options, defaults, and validation rules.

Operations

Check service status, logs, restart, and reconfigure.

Output Format

Configure receivers for NDJSON over TCP.

Troubleshooting

Diagnose service, API, receiver, queue, and checkpoint issues.
The wizard collects credentials and stream settings, then can install and start stellar-alert-case-syslog.service automatically. Manual CLI operation remains available for automation and testing.