Existing engines

Optional engines AarView reads directly: event store, endpoint manager, threat intelligence platform, Cortex and mail. Compatibility list on request.

Alerts from any SIEM arrive through Connected sources, with nothing to set here. The engines below are optional: AarView reads them directly to enrich some pages.

Compatible engines

Today each direct-read capability below works with one type of compatible engine. The list of compatible engines is given by CyberAar on request. AarView is designed so that the engine behind a capability can be replaced: an adapter layer is planned to support other engines.

Settings

All are set in .env, then:

docker compose up -d

Capability	What it brings	Settings
Event store	events, map	`EVENTS_URL`, `EVENTS_USER`, `EVENTS_PASSWORD`, `EVENTS_CA_CERT`
Endpoint manager	agents, quarantine	`ENDPOINTS_API_URL`, `ENDPOINTS_API_USER`, `ENDPOINTS_API_PASSWORD`, `ENDPOINTS_API_CA_CERT`
Threat intelligence platform	threat intelligence	`INTEL_URL`, `INTEL_API_KEY`, `INTEL_CA_CERT`
Cortex	observable analysis	`CORTEX_URL`, `CORTEX_API_KEY`, `CORTEX_CA_CERT`
Mail	notifications, account links	`SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASSWORD`

Not configured, by default

An empty value means “not configured”, and the page that needs it says so. No engine address has a default value: an engine stays “not configured” until you set it.

TLS verified

TLS to every engine is verified. If an engine uses a private authority:

put the authority’s file in the certs/ folder;
refer to it by its path inside the container, /certs/<file>.

EVENTS_URL=https://events.example.org
EVENTS_USER=aarview-reader
EVENTS_PASSWORD=...
EVENTS_CA_CERT=/certs/internal-ca.pem

The names and addresses above are examples.

AI assistant

The AI assistance features need a connected AI service (AI_SERVICE_URL, AI_SERVICE_TOKEN). Without it, the panels concerned say the service is not connected.