Skip to main content

​
Quickstart

For a new deployment, validate the data path in the foreground first. After Alert and Case delivery work as expected, use the Setup Wizard once to install the verified configuration as a systemd service.

​
1. Get the script

Python 3.9+ is required. You need:
  • network access to the Stellar Cyber API
  • network access to the destination TCP listener
  • an email-format Stellar Cyber User ID
  • an All-Access API token

​
2. Set the token for foreground testing

Using the environment variable avoids placing the token directly in shell history.

​
3. Test Alert forwarding first

Start with Alert only. Do not use the Wizard or systemd yet.
Confirm that:
  • the process starts without authentication/API errors
  • Alert records arrive at the TCP receiver
  • each received line is one JSON object
--initial-lookback-hours 0 limits the initial fetch to a one-minute window. For Alert, the window is anchored to the stable fetch cutoff. Let it run for a few cycles, then press Ctrl+C.
If production will use Alert only, you can skip the combined-stream test after this step succeeds.

​
4. Test Alert and Case together

If production will use both streams:
Verify Alert and Case records at their configured destinations, then press Ctrl+C. The two streams may use the same receiver or different IP/port combinations.

​
5. Move the verified settings to systemd

Run the Wizard:
Enter the values that passed foreground testing:
  1. Stellar Cyber host
  2. email-format User ID
  3. All-Access API token
  4. Alert enabled/disabled
  5. Case enabled/disabled
  6. interval and destination for each enabled stream
  7. initial lookback
When asked:
choose Yes. The Wizard installs, enables, and starts:

​
6. Verify production operation

Confirm there are no repeating API/authentication/TCP delivery errors and that receiver data continues to arrive.

​
7. Routine log checks

Live logs:
Recent logs:
Today’s logs:
Pressing Ctrl+C while following the journal stops only the log view, not the service.
For all CLI options and defaults, see Configuration.