AarView Documentation
Version described: 1.78.0 The managed SOC: AarSOC documentation →
Documentation contents

AarView · Get started

Requirements

Server, memory, disk, DNS name, network and licence: what you need before installing the AarView standalone edition.

On this page

Server

  • A Linux server with Docker 24 or later and Docker Compose v2.
  • The openssl and curl tools.
  • 2 vCPU and 6 GB of RAM at least. The containers are capped at 3.5 GB together.
  • 4 vCPU and 8 GB recommended.
  • 20 GB of disk to start.

Name and network

  • A DNS name for the portal that resolves to this server (for example aarview.example.org).
  • Port 443 reachable by your users. Nothing else needs to be open inbound.

Only that name is served: the portal refuses any TLS connection asking for another one.

Outbound connections

By default, AarView reads public sources over outbound HTTPS. These requests carry no data of yours, only dates and the sources’ own addresses:

  • the CVE feed (NVD and the CISA KEV catalogue of actively exploited flaws);
  • ENISA’s EUVD;
  • the official CERTs’ news feeds.

On a closed network, switch them off in .env:

CVE_FEED_ENABLED=false
EUVD_ENABLED=false
NEWS_ALERTS_ENABLED=false
NEWS_SOURCES=

The pages concerned then say the feed is off.

Licence

A licence key from CyberAar, bound to the instance id the installer prints. You can install AarView before you have it: see Licence.

What you can connect afterwards

Nothing is required to start. After installation you can connect:

  • your SIEM’s alerts, through Connected sources;
  • existing engines: an event store, an endpoint manager and a threat intelligence platform, each compatible (list on request), Cortex, a mail server.