Broker Server Setup

When deploying multiple canary appliances in an air-gapped network, managing them individually becomes challenging. A Broker Server provides centralized event collection, alerting, and monitoring - all without requiring internet connectivity.

What is a Broker Server?

A broker server is a lightweight aggregation point that sits within your air-gapped network and receives events from all your canary appliances. It provides:

• Centralized Dashboard - View all canary events from a single web interface
• Real-time Alerting - Get instant notifications via syslog, email, or SNMP
• SIEM Integration - Forward events to your existing security infrastructure
• Event Correlation - Identify patterns across multiple appliances
• Easy Export - Package all events for transfer to Signal Canary cloud

Architecture Overview

The broker architecture is designed for simplicity and reliability in isolated environments:

┌─────────────────────────────────────────────────────────────┐
│                    Air-Gapped Network                        │
│                                                              │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐                   │
│  │ Canary 1 │  │ Canary 2 │  │ Canary 3 │   ...             │
│  └────┬─────┘  └────┬─────┘  └────┬─────┘                   │
│       │             │             │                          │
│       └─────────────┼─────────────┘                          │
│                     ▼                                        │
│              ┌─────────────┐                                 │
│              │   Broker    │────► Syslog / SIEM              │
│              │   Server    │────► Email Alerts               │
│              └─────────────┘────► SNMP Traps                 │
│                     │                                        │
│                     ▼                                        │
│              ┌─────────────┐                                 │
│              │  Dashboard  │ (Web UI)                        │
│              └─────────────┘                                 │
│                                                              │
└─────────────────────────────────────────────────────────────┘
                     │
            USB/Secure Transfer
                     ▼
            ┌─────────────┐
            │Signal Canary│ (Cloud - Optional)
            │  Dashboard  │
            └─────────────┘
    

Key Features

Deployment Guide

Setting up a broker server takes just a few steps:

# Extract and setup
tar -xzf canary_broker.tar.gz
cd canary_broker

# Create configuration
cp config.example.yaml config.yaml
nano config.yaml

# Start the server
./start_broker.sh

Alerting Configuration

The broker supports multiple alerting channels that can be enabled simultaneously:

Syslog

Forward events to any syslog server (rsyslog, syslog-ng, Graylog, etc.):

Email (SMTP)

Send email alerts to your internal mail server. Supports authentication and TLS for secure delivery within your network.

SNMP Traps

Generate SNMP v2c or v3 traps for integration with network management systems.

SIEM Integration

The broker can forward events to your existing SIEM infrastructure:

Splunk

Use the HTTP Event Collector (HEC) to send events directly to Splunk:

siem:
  splunk_hec:
    enabled: true
    url: "https://splunk.internal:8088/services/collector"
    token: "your-hec-token"
    index: "security"
    source: "signal_canary"

QRadar

Use LEEF format over syslog for native QRadar integration:

siem:
  syslog:
    enabled: true
    host: "qradar.internal"
    port: 514
    format: "leef"

ArcSight

Use CEF format for ArcSight SmartConnector compatibility:

siem:
  syslog:
    enabled: true
    host: "arcsight.internal"
    port: 514
    format: "cef"

Best Practices

Security

• Use HTTPS - Even in internal networks, encrypt broker traffic with TLS
• Strong API Keys - Generate unique, random API keys for each appliance
• Network Segmentation - Place the broker on a management network if possible
• Regular Exports - Periodically export data for offline backup and cloud analysis

High Availability

• SQLite Performance - The default SQLite database handles thousands of events per day easily
• Disk Space - Plan for ~1KB per event; 10,000 events ≈ 10MB
• Backup Strategy - The database is a single file - easy to backup

Alert Tuning

• Start Broad - Enable alerts for all high/critical events initially
• Add Cooldowns - Prevent alert fatigue with appropriate cooldown periods
• Test First - Trigger test events to verify alerting works before relying on it

Getting Help

If you need assistance setting up your broker server:

1. Check the included README in the broker package
2. Review the configuration examples
3. Contact our Enterprise support team for deployment assistance