Telemetry readiness checklist
Four questions decide whether a node deployment is straightforward or turns into a project. Work through them before the call and we can skip straight to the interesting part. A "no" on any of them is not a blocker — it just changes the plan.
Zeek and Suricata read wire data, which means the node needs a mirror feed from the uplinks you care about. Cisco Catalyst, Nexus, and most equivalents support this — the question is usually whether you have a mirror session free, since many platforms cap how many can run at once.
The node reaches us by opening a WireGuard or Headscale tunnel outward. Nothing needs to come in, but that one outbound flow does need to be permitted. Estates with a strict default-deny egress policy will need a single rule added.
Ideally the appliance's management interface sits on an out-of-band network. The reason is practical: when the production path is congested or down is exactly when you need to reach the thing that tells you why.
Wire capture covers a lot, but device-level flow records and syslog fill in what the mirror cannot see. If your gear is already exporting somewhere, pointing a copy at the node is usually a one-line change.
However that went
Four ticks means a deployment is straightforward. Fewer means there is something to design around first, which is worth a conversation either way. Bring your answers to the call.
Book a discovery call