CyberCLI
Sign in →

Reference · task by task

How-to recipes.
Every task. Step by step.

Engine docs answer what does this subsystem do. How-tos answer how do I do this specific task. Each recipe follows the same five-section shape — prereqs, what you'll do, ordered steps with copy-pasteable commands, verify, and the most common failure modes with fixes.

5 recipes 5 categories Average 9 min per recipe

1 recipe

Install

From a fresh host to a running engine.

Install CyberCLI from scratch
~8m

From a fresh Ubuntu VM (or LXC) to a running engine with the dashboard open at /first-30-minutes, in about 8 minutes.

4 steps · last updated 2026-06-07

1 recipe

Connectors

Wire CyberCLI to the systems you already run.

Connect your first Wazuh manager
~12m

Point CyberCLI at an existing Wazuh manager, watch the first alerts flow through the SOC pipeline, and verify the audit chain advances.

3 steps · last updated 2026-06-07

1 recipe

Delivery

Get alerts where your team actually reads them.

Set up CYCON-aware Slack routing
~7m

Configure Slack to fire only at CYCON 3 or below so peacetime noise stays out of your operator channel — without losing high-CYCON alerts.

4 steps · last updated 2026-06-07

1 recipe

AI

Choose, configure, and verify the AI lane that fits your sovereignty + budget.

Wire the local AI lane via Ollama
~15m

Run the entire AI digest path on a local Ollama server — no API costs, no data egress, full sovereignty.

4 steps · last updated 2026-06-07

1 recipe

Ops

Day-2 work — tuning, suppression, calibration.

Author your first suppression rule
~5m

Tell the SuppressionMatcher 'this pattern is noise' once — and have every future matching event silently dropped, with the audit chain still capturing the suppression.

4 steps · last updated 2026-06-07

How we write recipes

Every recipe ships only when every step lands on a real install.

Locked shape. Five sections, in order, every recipe. Prereqs first, then what you'll do, then ordered steps with copy-pasteable commands, then verify, then troubleshoot. No clever variations.

Live-verified. Every command in a recipe was run on the live acceptance install before the recipe shipped. The verify steps are the steps we ran ourselves; they're what we'd want a buyer to confirm.

Troubleshoot is honest. The 3-5 failure modes per recipe are the ones we hit ourselves first. If a new failure mode shows up in support, it lands on the recipe — there's no separate FAQ page that says different things.