Configuration

The relay supports both an interactive setup wizard and the original CLI interface.

Authentication and global options

Option	Purpose
`--setup`	Run the interactive setup/systemd wizard
`--host`	Stellar Cyber host
`--userid`	Stellar Cyber user ID (email format)
`--token`	All-Access API token
`STELLAR_TOKEN`	Preferred environment-variable source for the API token
`--initial-lookback-hours`	First-run lookback when no checkpoint exists; `0` means a 1-minute initial window. Alert is anchored to the stability cutoff
`--backfill DAYS`	Fetch/send the last N days every cycle, ignoring normal checkpoints
`--db-path`	SQLite queue/checkpoint database path
`--log-dir`	Send/fetch log directory
`--lock-path`	Single-instance lock path
`--send-log-retention-days`	Retention for send summary logs
`--debug`	Print fetch/enqueue/send diagnostics to stderr

For manual operation, using STELLAR_TOKEN is preferable to placing the token directly on the command line.

Alert stream

Option	Purpose	Default/example
`--alert-interval SEC`	Alert fetch/send interval	`60` in the wizard
`--alert-syslog-ip IP`	Alert destination IPv4/IPv6 address	required when enabled
`--alert-syslog-port PORT`	Alert destination TCP port	`5201` in the wizard
`--alert-fetch-stability-lag-sec SEC`	Closed-window watermark lag for incremental alert fetch	`120`
`--alert-sent-retention-minutes`	Retain already-sent alert queue rows for this many minutes	`10`

All three stream options—interval, IP, and port—must be supplied together.

Case stream

Option	Purpose	Default/example
`--case-interval SEC`	Case fetch/send interval	`300` in the wizard
`--case-syslog-ip IP`	Case destination IPv4/IPv6 address	required when enabled
`--case-syslog-port PORT`	Case destination TCP port	`5202` in the wizard
`--case-min-score`	Minimum case score to forward	`10`
`--case-include-summary` / `--no-case-include-summary`	Include or omit case summary data	enabled
`--case-format-summary` / `--no-case-format-summary`	Enable or disable case-summary formatting	enabled
`--case-fetch-limit`	Case API fetch page limit	`200`

Stream state rules

No options for a stream

If all three required options for a stream are omitted, that stream is disabled.

Partial configuration

If any required stream option is supplied, all three must be present.

Input validation

Intervals must be positive, destination IPs must be valid IPv4/IPv6 addresses, and ports must be between 1 and 65535.

At least one stream

Alert, Case, or both must be fully configured.

Persistent state

Unless overridden, runtime state is stored below:

~/.local/state/stellar_alert_case/
├── queue.db
├── stellar_alert_case.lock
└── logs/

The SQLite database persists queued records and checkpoints across process restarts. Unsent records are retained when the TCP destination is unavailable.

Backfill

--backfill DAYS is a special replay mode. It fetches/sends the requested historical window every cycle and ignores normal checkpoints. Use it deliberately because replaying a window can resend records.

Debug mode

python3 Stellar_Alert_Case_Syslog.py ... --debug

Use debug mode for troubleshooting and disable it when the additional output is no longer needed.

Although option names contain syslog, the payload format is newline-delimited JSON (NDJSON) over TCP.

Overview

Get started

Operations

Authentication and global options

Alert stream

Case stream

Stream state rules

Persistent state

Backfill

Debug mode

​Authentication and global options

​Alert stream

​Case stream

​Stream state rules

​Persistent state

​Backfill

​Debug mode

Authentication and global options

Alert stream

Case stream

Stream state rules

Persistent state

Backfill

Debug mode