Skip to main content
At least one stream must be fully configured. Alert and case forwarding can be enabled independently or together.

​
Before you start

Make sure the relay host has:
  • Python 3
  • Network access to the Stellar Cyber API
  • Network access to each destination TCP listener
  • Valid Stellar Cyber API access for the runtime script
  • Stellar_Alert_Case_Syslog.py

​
Alert only

Use this mode when only alert forwarding is required.
The alert stream requires all three settings: interval, destination IP, and destination port.

​
Case only

A case-only deployment can be started with:
The case stream requires an interval, destination IP, and destination port. The example also enables the recommended case summary and fetch-timeout options.

​
Alert and case together

Configure both complete streams in the same process:
Alert and case streams can point to the same receiver or to separate destinations.

​
Stream enablement rules

  • If all options for a stream are omitted, that stream is disabled.
  • If configuration for a stream is started but one of its required options is missing, that stream is an error.
  • At least one stream must be fully configured.

​
What the receiver gets

The relay sends newline-delimited JSON (NDJSON) over TCP:
Each JSON object occupies one line. Alert and case records can be distinguished using fields in the emitted JSON.

Configuration reference

Review the available stream and case options.

Run continuously

Install the relay as a systemd service.