Trawl

Trawl runs Zeek and Suricata as first-class Kubernetes citizens on immutable infrastructure — no SSH, no package manager, every tool in a pod. Sensors watch traffic continuously; packet capture is short-lived, triggered by what the sensors see, and bounded by design rather than by convention.

Evidence, not telemetry

A packet capture is the most sensitive artifact a network tool produces. Captures land in a private bucket, are retrieved only through a Kubernetes-authorized gateway, and are recorded in a write-once audit ledger. See evidence handling.

Capture is deliberate

Capture runs in node-pinned Jobs with two Linux capabilities, no API token, and an unprivileged reporter sidecar — so the component holding raw traffic is the one that can do least.

One envelope, both sensors

Suricata EVE JSON and Zeek JSON describe the same traffic differently. A sidecar normalizes both into one versioned envelope, so correlation and pivoting happen in a single Grafana view.

Restart-safe triggers

Persistent cursors, direction-neutral flow keys, and cooldown buckets make automatic capture exactly-once within a window — a restart does not replay yesterday’s alerts as today’s captures.

Where to start

• Operating an installation — the runbook is the on-call document, organized by the signal that brings you to it.
• Handling captured traffic — evidence handling covers who can see captures, what Trawl trusts, and how evidence is reviewed and destroyed.
• Understanding a design choice — the ADRs record what was decided, when, and what it cost.