Sekoia Self-Hosted 1.0.1

This is the documentation for Sekoia Self-Hosted 1.0.1. It describes the configuration keys, CLI commands, and behavior of this release only.

For what Sekoia Self-Hosted is and who it is for, see the section introduction. To check whether a more recent release is available, see Documentation versions.

Quick start path

If you are new to Sekoia Self-Hosted, follow this sequence:

Read the Reference architecture to understand the platform topology.
Validate your infrastructure against the Technical requirements and Network requirements.
Prepare your config.yml with Configure the deployment.
Follow the Deploy the platform guide.
Create your first user with the Set up the first administrator account guide.
Import the threat intelligence with the Import the CTI database guide.
Turn on the platform backups with the Back up the platform guide.
Get familiar with the self-hosted-controller (SHC) interface for day-to-day interactive operations.
Set up continuous monitoring using the Monitor your platform guide.
Run platform diagnostics to validate service health.

Document	What you will find
Reference architecture	Platform components, infrastructure topology, node roles, high availability design, and data workflow.

Document	What you will find
Technical requirements	Hardware, OS, storage, network, and operational requirements before you begin.
Network requirements	Full table of required network flows, ports, and protocols.
The deployment process	High-level overview of the deployment engine, execution modes, and lifecycle operations.
Deploy the platform	Step-by-step installation: download, verification, initialization, and post-deployment validation.
Configure the deployment	Copyable `config.yml` starter configuration and explanations for every required field.

Document	What you will find
Set up the first administrator account	How to provision the first administrator account and configure initial access.
Use the self-hosted-controller (SHC) interface	The interactive self-hosted-controller (SHC) interface: command input, node, cluster and storage views, and diagnostics.
Import the CTI database	How to import the Sekoia CTI database into the platform with the SHC.
Back up the platform	How to turn on the backups of Vault, PostgreSQL, ArangoDB, and ClickHouse, trigger a backup, check the backup status, and restore from a backup.
Update the security content	How to update the detection rules and intake formats after the installation.
Apply a configuration change	How to change `config.yml` after the installation and apply it with an idempotent run of `Install`, and what the run restarts.
Rotate the certificate and credentials	How to replace the platform TLS certificate and credentials, then restart the platform services to load them.
Patch and restart the nodes	How to patch the nodes one at a time without an outage, and how to run a cold restart of the whole cluster.
Reset or destroy the platform	How to delete the platform workloads and keep the cluster, or destroy the platform and wipe the storage disks before a reinstallation.

Document	What you will find
Monitor your platform	Observability stack overview, daily monitoring workflows, and self-hosted-controller (SHC) diagnostic command reference.
Run platform diagnostics	How to run targeted Prometheus health checks for platform services.
Platform alerts reference	Every platform alert by group, with its severity, its impact, and the diagnostic to run.
Debug your deployment	Full self-hosted-controller (SHC) debug command reference with remediation guidance and log collection for support.

Document	What you will find
Release notes v1.0.1	Content of the release, feature scope, and functional constraints.