Installation

Prerequisite: These steps assume Suricata is already installed and running on the system. Rockfish ingests Suricata’s EVE output — it does not capture packets itself. Rockfish creates a Unix socket (default /var/run/rockfish/rockfish.sock) that Suricata connects to as an eve-log unix_stream client, so point Suricata’s eve-log at that socket after installing.

Deployment Kit: The Suricata plugins (line-rate capture, OT/IIoT protocol decoders, per-flow telemetry) and the Docker/APT deployment recipe live in the Rockfish Toolkit — the open deployment kit for Rockfish NDR.

Option 1 — Quick install (script)

curl -fsSL https://docs.rockfishndr.com/install.sh | bash

The installer auto-detects your platform and installs via the appropriate method:

• Debian/Ubuntu: APT repository (recommended)
• Other Linux: Docker or binary
• macOS: Docker or binary

On an APT install it then prompts whether to enable the two systemd services — detection (rockfish.service) and reporting (rockfish-report.service, every 10 minutes) — and finishes by running the verify diagnostics. Skip the prompt non-interactively with ROCKFISH_SERVICES=yes (or no).

Environment overrides:

# Install specific version
ROCKFISH_VERSION=2026.07.6 curl -fsSL https://docs.rockfishndr.com/install.sh | bash

# Force specific installation method
ROCKFISH_METHOD=apt curl -fsSL https://docs.rockfishndr.com/install.sh | bash
ROCKFISH_METHOD=docker curl -fsSL https://docs.rockfishndr.com/install.sh | bash

Verify an installation: run read-only diagnostics that confirm the binary runs, libduckdb resolves, the bundled DuckDB extensions are present, and the systemd units and APT wiring are in place. Exits non-zero if anything is missing:

curl -fsSL https://docs.rockfishndr.com/install.sh | bash -s -- verify

The installer is maintained in the Rockfish Toolkit (install/install.sh); this site serves a synced copy at docs.rockfishndr.com/install.sh.

Option 2 — APT repository (Debian/Ubuntu)

The recommended installation method for Debian-based systems. Enables automatic updates via apt-get upgrade.

Install

Run the four commands below. Each is intentionally a single line so you can copy and paste them straight into a terminal.

sudo curl -fsSLo /usr/share/keyrings/rockfish-archive-keyring.gpg https://repo.rockfishndr.com/rockfish-archive-keyring.gpg

echo "deb [arch=amd64 signed-by=/usr/share/keyrings/rockfish-archive-keyring.gpg] https://repo.rockfishndr.com stable main" | sudo tee /etc/apt/sources.list.d/rockfish.list

sudo apt update

sudo apt install rockfish

Update

sudo apt update && sudo apt upgrade rockfish

Requirements

• Operating System: Debian 11+ or Ubuntu 20.04+ (amd64) for the APT package; other Linux / macOS via Docker.
• Suricata: already installed and running with an eve-log output. Rockfish ingests Suricata’s EVE stream — it does not capture packets itself. Point Suricata’s eve-log at the Unix socket Rockfish creates (default /var/run/rockfish/rockfish.sock, unix_stream filetype).
• Architecture: x86_64 (amd64); ARM64 via Docker.
• Memory: 2 GB minimum (4 GB+ recommended for high-traffic networks).
• Storage: depends on retention policy (10 GB minimum).
• Runtime: libduckdb 1.4.4 — the installer fetches the matching version automatically (customer-provided on air-gapped hosts).
• Tooling: curl and sudo (the quick-install script uses both).

Installation Directory Structure

After installation, Rockfish NDR is installed to /opt/rockfish:

/opt/rockfish/
├── bin/        # Compiled rockfish binary
├── etc/        # Configuration + example config/env/theme files
├── lib/        # DuckDB extensions and libraries
└── scripts/    # Deployment toolkit — systemd units, cron examples, installer

System Directories

Deployment Toolkit (/opt/rockfish/scripts/)

The package ships as a complete deployment toolkit. Beyond the binary, it bundles everything needed to run a sensor into /opt/rockfish/scripts/. These are the editable reference copies; the two .service units are also installed to /lib/systemd/system/ so systemctl works out of the box.

Configuration

Configuration File

# Copy or create configuration (the example ships in etc/)
sudo cp /opt/rockfish/etc/rockfish.yaml.example /opt/rockfish/etc/rockfish.yaml

Rockfish searches for configuration in this order:

1. --config <path> (CLI argument)
2. ./rockfish.yaml
3. /etc/rockfish/rockfish.yaml
4. ~/.config/rockfish/rockfish.yaml

Environment File

Credentials and secrets are stored in an environment file:

# Create environment file
cat > /opt/rockfish/etc/rockfish.env << 'EOF'
ROCKFISH_S3_BUCKET=rockfish-data
ROCKFISH_S3_REGION=us-east-1
AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...
ABUSEIPDB_API_KEY=...
EOF

Configure Suricata

Rockfish ingests Suricata’s EVE stream over a Unix socket that Rockfish creates and Suricata connects to (as an eve-log unix_stream client). Three things must be true for the connection to work:

1. Point Suricata’s eve-log at the socket. In suricata.yaml:

outputs:
  - eve-log:
      enabled: yes
      filetype: unix_stream
      filename: /var/run/rockfish/rockfish.sock

2. Give Suricata access to the socket. Rockfish creates the socket owned by user/group rockfish (in /var/run/rockfish, provisioned by the service’s RuntimeDirectory=). Suricata typically runs as its own user, so add it to the rockfish group via a systemd drop-in — otherwise the connection fails with permission denied:

sudo systemctl edit suricata
# In the editor, add:
[Service]
SupplementaryGroups=rockfish

3. Start order. Rockfish must be running and listening before Suricata connects — it’s the socket’s server. rockfish.service is ordered Before=suricata.service, so with both under systemd, Rockfish starts first. Until Suricata connects, Rockfish has no input and restarts on a loop (Restart=always) — this is expected, not a failure; it settles as soon as Suricata is feeding the socket.

Systemd Services

The package installs two systemd units to /lib/systemd/system/ (editable reference copies also live in /opt/rockfish/scripts/):

• rockfish.service — the detection engine (rockfish detect)
• rockfish-report.service — the reporting service (rockfish report --serve)

# Reload systemd to pick up the units
sudo systemctl daemon-reload

# Enable + start both on boot
sudo systemctl enable --now rockfish rockfish-report

# Check status / follow logs
sudo systemctl status rockfish rockfish-report
sudo journalctl -u rockfish -f

Restart loop is normal pre-Suricata: if you enable the services before Suricata is configured to connect, rockfish.service will cycle (start → clean exit → restart) until the EVE socket has a client. Configure Suricata (above) and it settles. This is why the detection unit uses Restart=always, not on-failure.

Daily Rule Updates (cron)

Install the bundled cron example to pull the latest ruleset every day and hot-reload Suricata (rockfish rule update is license-exempt):

sudo cp /opt/rockfish/scripts/rockfish-rule-update.cron \
        /etc/cron.d/rockfish-rule-update

Edit the file to change the schedule (default: daily at 03:17). For a weekly curated refresh instead, use /opt/rockfish/scripts/cron-rules-refresh.sh.

Option 3 — Docker

Pull the Rockfish NDR image from Docker Hub:

docker pull rockfishnetworks/toolkit:latest

The toolkit image includes the Rockfish binary with all features enabled.

Running Rockfish (Ingest Mode)

docker run -d \
  --name rockfish \
  -v /opt/rockfish/etc:/opt/rockfish/etc:ro \
  -v /data/rockfish:/data/rockfish \
  -p 3000:3000 \
  -p 8082:8082 \
  rockfishnetworks/toolkit:latest \
  rockfish ingest --socket /var/run/suricata/eve.sock

Docker Compose

Example docker-compose.yml:

version: '3.8'

services:
  rockfish:
    image: rockfishnetworks/toolkit:latest
    ports:
      - "3000:3000"
      - "8082:8082"
    volumes:
      - ./config:/opt/rockfish/etc:ro
      - ./data:/data/rockfish
    command: ["rockfish", "ingest", "--socket", "/var/run/suricata/eve.sock"]
    restart: unless-stopped

Verify Installation

# Check version
rockfish --version

# Show configuration and features
rockfish config

Uninstalling

APT Package

# Remove package (keeps configuration)
sudo apt remove rockfish

# Remove package and configuration
sudo apt purge rockfish

# Remove repository and key
sudo rm /etc/apt/sources.list.d/rockfish.list
sudo rm /usr/share/keyrings/rockfish-archive-keyring.gpg

Docker

docker stop rockfish
docker rm rockfish
docker rmi rockfishnetworks/toolkit:latest

Next Steps

• Quick Start - Ingest, hunt, and report in minutes
• Configuration - Full YAML configuration reference