> ## Documentation Index
> Fetch the complete documentation index at: https://stellar-relay.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Stellar Alert & Case Relay

> Forward Stellar Cyber alerts and cases into existing SIEM and SOC workflows.

Stellar Alert & Case Relay is a lightweight Python daemon for organizations that already operate a SIEM or SOC portal and want Stellar Cyber detections delivered directly into those existing workflows.

<Info>
  The runtime script and CLI retain the historical **Syslog** naming, but the documented wire format is **newline-delimited JSON (NDJSON) over TCP**.
</Info>

## Why it exists

On-prem SOC teams often already have established SIEM dashboards, monitoring portals, and operational processes. They still need Stellar Cyber NDR/XDR alerts and cases inside those systems without manual exports or one-off integrations.

```text theme={null}
Stellar Cyber API
       |
       v
Python Relay Daemon
       |
       v
Customer SIEM / SOC Portal
```

## What it does

<CardGroup cols={2}>
  <Card title="Alert and case forwarding" icon="arrow-right-arrow-left">
    Pulls alerts and cases from the Stellar Cyber API and forwards them to downstream SOC systems.
  </Card>

  <Card title="Flexible stream modes" icon="sliders">
    Run alert-only, case-only, or both streams from the same daemon.
  </Card>

  <Card title="Built for operations" icon="rotate">
    Supports fetch checkpointing, send retry/recovery, and backfill for continuous operation.
  </Card>

  <Card title="Separate destinations" icon="route">
    Alert and case streams can use independent destination IP addresses and ports.
  </Card>
</CardGroup>

## At a glance

| Item            | Behavior                                      |
| --------------- | --------------------------------------------- |
| Source          | Stellar Cyber API                             |
| Runtime         | Python daemon                                 |
| Transport       | TCP                                           |
| Payload framing | NDJSON, one JSON object per line              |
| Stream modes    | Alert-only, case-only, or both                |
| Destinations    | Independent alert and case IP/port settings   |
| Operations      | Checkpoint, retry/recovery, backfill, systemd |

## Typical deployment

The relay runs on a Linux host that can reach both Stellar Cyber and the destination SIEM/SOC receiver. For long-running deployments, run it under `systemd` so it starts at boot and automatically recovers from process failures.

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Start an alert stream, a case stream, or both.
  </Card>

  <Card title="Configuration" icon="gear" href="/configuration">
    Configure stream intervals, destinations, and case options.
  </Card>

  <Card title="Run with systemd" icon="server" href="/operations">
    Keep the relay running continuously and inspect service logs.
  </Card>

  <Card title="Output format" icon="code" href="/output-format">
    Prepare your receiver for TCP NDJSON delivery.
  </Card>
</CardGroup>