AarView Documentation
Version described: 1.78.0 The managed SOC: AarSOC documentation →
Documentation contents

AarView

AarView overview

AarView is a security orchestrator you install on your own server, above the SIEM you already run. What it does, and what it does not do.

On this page

AarView is software. You install it on a server of your own, with its identity provider, and it orchestrates the security operations you already run. It does not replace your SIEM: it reads it.

What AarView brings

  • Your SIEM’s alerts, in one place. They arrive through Connected sources: Wazuh, Elastic Security, Splunk, IBM QRadar, Microsoft Sentinel, Graylog, OpenSearch Security Analytics, or a generic JSON format for any other tool.
  • Cases. Alerts become incidents, which can be grouped into cases, with their timeline, observables, notes and audit trail.
  • SOAR with human approval. Rules trigger actions and playbooks; an action that touches a machine waits for an administrator’s decision. SOAR rules have no isolate, kill or block action.
  • Reports. PDF reports per incident, per machine and per period, in French or English.
  • Intelligence. An indicator watchlist, reads of Cortex, and of a threat intelligence platform when a compatible one is connected (list on request).
  • Isolation between clients. One instance can serve several organisations: each account belongs to a client, and the database enforces that isolation row by row.

Details are on the Features page.

What AarView does not do

  • It does not collect your logs and ships no detection engine. Detection stays in your SIEM.
  • It does not act on your machines on its own. Every action on a host goes through human approval.
  • It contains no AarSOC engine. The standalone edition installs the portal and its identity provider, nothing else.

Standalone edition

The standalone edition fits on one Linux server with Docker. One script, install.sh, generates the secrets and the certificate, builds and starts the stack, then configures the identity provider: mandatory two-factor authentication, account lockout, password policy and set-password links.

To begin:

  1. check the requirements;
  2. follow the installation;
  3. do the first sign-in;
  4. install the licence.

Licence

AarView is licensed software, published by CyberAar. The licence is bound to your installation by its instance id. See Licence.

Looking for the managed SOC operated by CyberAar rather than the software? See the AarSOC documentation.