RunReveal

https://docs.runreveal.com/
Admin
RunReveal documentation provides information and guides for using the RunReveal platform, a tool for...
Tokens:309,104
Snippets:3,161
Trust Score:7.6
Update:1 week ago
Show doc for...
Tokens:
Raw
### Install Reveald binary on Linux (amd64)

Source: https://docs.runreveal.com/sources/reveald/installation

Downloads and installs the Reveald binary for Linux amd64, makes it executable, and verifies the installation with the help command.

```bash
curl -L https://github.com/runreveal/reveald/releases/latest/download/reveald-linux-amd64.tar.gz | sudo tar --directory /usr/local/bin -xz
sudo chmod +x /usr/local/bin/reveald
reveald --help
```

--------------------------------

### Enable and start reveald service

Source: https://docs.runreveal.com/sources/reveald/deployment/systemd

Reloads systemd, enables the service to start on boot, and starts it.

```bash
sudo systemctl daemon-reload
sudo systemctl enable reveald
sudo systemctl start reveald
```

--------------------------------

### Install RunReveal CLI with Homebrew

Source: https://docs.runreveal.com/how-to-guides/detections-signals-alerts-quick-start

Installs the RunReveal CLI using Homebrew. Run this before initializing the workspace.

```bash
brew install runreveal/runreveal/runreveal
```

--------------------------------

### Install reveald binary

Source: https://docs.runreveal.com/sources/reveald/deployment/systemd

Downloads the latest reveald binary and installs it to /usr/local/bin.

```bash
curl -L https://github.com/runreveal/reveald/releases/latest/download/reveald-linux-amd64.tar.gz | sudo tar --directory /usr/local/bin -xz
sudo chmod +x /usr/local/bin/reveald
```

--------------------------------

### Install reveald on Linux

Source: https://docs.runreveal.com/sources/reveald/quickstart

Downloads and installs the latest reveald binary for Linux to /usr/local/bin using curl and sudo tar. Run `reveald --help` afterward to verify the installation.

```bash
curl -L https://github.com/runreveal/reveald/releases/latest/download/reveald-linux-amd64.tar.gz | sudo tar --directory /usr/local/bin -xz
reveald --help
```

--------------------------------

### Verify Reveald installation with --help

Source: https://docs.runreveal.com/sources/reveald/installation

Displays the available commands and flags for Reveald. Use this to verify the installation.

```bash
reveald --help
```

--------------------------------

### Install RunReveal CLI on macOS and Linux

Source: https://docs.runreveal.com/how-to-guides/onboarding

Install the RunReveal CLI using Homebrew on macOS or by downloading the Linux binary. The macOS commands use brew tap, trust, and install. The Linux commands download and extract the tarball, then move the binary to /usr/local/bin/.

```bash
# macOS
brew tap runreveal/runreveal
brew trust --formula runreveal/runreveal/runreveal
brew install runreveal
 
# Linux
curl -L https://github.com/runreveal/homebrew-runreveal/releases/latest/download/runreveal-linux-amd64.tar.gz | tar xz runreveal
sudo mv runreveal /usr/local/bin/
```

--------------------------------

### Basic argument usage example

Source: https://docs.runreveal.com/ai-chat/prompts

Example of a prompt template that uses a single argument to insert log data into a sentence.

```handlebars
Please analyze the following log data: {{log_data}}
```

--------------------------------

### Example prompt for creating a graph

Source: https://docs.runreveal.com/dashboards

A real example of a natural language prompt for creating a graph. The AI generates the SQL query and visualization configuration automatically.

```text
Create a graph for okta_logs showing event counts by eventType over the last 7 days using hourly intervals as a line chart.
```

--------------------------------

### Connect to workspace with runreveal init

Source: https://docs.runreveal.com/how-to-guides/detections-signals-alerts-quick-start

Initializes the CLI and connects to a workspace. Follow the prompts to authenticate and select your workspace.

```bash
runreveal init
```

--------------------------------

### Install Logstash on macOS

Source: https://docs.runreveal.com/sources/forwarders/logstash

Commands to install Logstash via Homebrew and verify the installation.

```bash
# Install (macOS)
brew install logstash
 
# Verify
logstash --version
```

--------------------------------

### runreveal api examples: list sources, query logs, create source

Source: https://docs.runreveal.com/reference/using-the-cli

Three example invocations of the api group. List sources, pipe a JSON query body into logs query-v3, and create a source with an inline JSON body.

```shell
# List sources
runreveal api sources list
 
# Query your logs
echo '{"query":"SELECT * FROM logs LIMIT 10"}' | runreveal api logs query-v3
 
# Create a source
runreveal api sources create --json '{"name":"my-source","type":"structured-webhook","ingestType":"webhook"}'
```

--------------------------------

### Install Vector via Homebrew (macOS)

Source: https://docs.runreveal.com/sources/forwarders/vector

Installs Vector using Homebrew and verifies the installation with `vector --version`.

```bash
# Install via Homebrew
brew install vector
 
# Verify installation
vector --version
```

--------------------------------

### Full Reveald configuration example

Source: https://docs.runreveal.com/sources/reveald/configuration

Production-ready configuration collecting from file, journald, and nginx_syslog sources, with a runreveal destination. Uses environment variable for webhook URL.

```json
{
  // Collect application logs, journald, and nginx access logs
  "sources": {
    "app": {
      "type": "file",
      "path": "/var/log/app/",
      "extension": ".log",
    },
    "journal": {
      "type": "journald",
    },
    "nginx": {
      "type": "nginx_syslog",
      "addr": "0.0.0.0:5514",
    },
  },
  "destinations": {
    "runreveal": {
      "type": "runreveal",
      "webhookURL": "$WEBHOOK_URL",
      "batchSize": 100,
      "flushFreq": "15s",
    },
  },
}
```

--------------------------------

### Start Vector with Debug Logging

Source: https://docs.runreveal.com/sources/forwarders/vector

Starts Vector with debug logging to review logs and diagnose startup issues. Useful when Vector won't start.

```bash
vector --config vector.toml --log-level debug
```

--------------------------------

### Validate and Start Logstash

Source: https://docs.runreveal.com/sources/forwarders/logstash

Commands to test the configuration file and start the Logstash process.

```bash
logstash -f ~/.config/logstash/logstash.conf --config.test_and_exit

logstash -f ~/.config/logstash/logstash.conf
```

--------------------------------

### Example Query with Parameters

Source: https://docs.runreveal.com/logs/queries

Shows a query using built-in time parameters and a custom array parameter to filter CloudTrail logs for AssumeRole events, excluding specified office IPs.

```sql
SELECT 
    eventName,
    srcIP,
    COUNT(*) as eventCount
FROM aws_cloudtrail_logs
WHERE receivedAt >= {from:DateTime}
  AND receivedAt < {to:DateTime}
  AND eventName = 'AssumeRole'
  AND srcIP NOT IN ({officeIPs:Array(String)})
GROUP BY eventName, srcIP
ORDER BY eventCount DESC
LIMIT 100
```

--------------------------------

### Start Vector

Source: https://docs.runreveal.com/sources/forwarders/vector

Validates the Vector configuration and runs Vector in the foreground or background to start forwarding logs.

```bash
# Make sure you're in the vector directory where the config file is located
cd vector
 
# Validate configuration
vector validate vector.toml
 
# Run Vector in foreground
vector --config vector.toml
 
# Or run in background
vector --config vector.toml --quiet &
```

--------------------------------

### Tail all .log files in a directory

Source: https://docs.runreveal.com/sources/reveald/sources/file

Watches `/var/log/app/` and tails all files with the `.log` extension. This is the simplest example for a directory of log files.

```json
{
  "sources": {
    "app": {
      "type": "file",
      "path": "/var/log/app/",
      "extension": ".log"
    }
  }
}
```

--------------------------------

### Multiple arguments example

Source: https://docs.runreveal.com/ai-chat/prompts

Example of a prompt template that uses multiple arguments to construct a more complex analysis request.

```handlebars
Analyze the following data from {{source}} for the period {{timeframe}}:

{{log_data}}

Focus on {{focus_area}} patterns.
```

--------------------------------

### runreveal detections create wizard interaction

Source: https://docs.runreveal.com/detections/detection-as-code/getting-started

Run the `runreveal detections create` command to interactively generate a detection YAML and SQL file. The wizard prompts for detection details such as name, description, categories, severity, risk score, ATT&CK classification, enabled status, and query type. After completion, it outputs the files `my-detection.yaml` and `my-detection.sql`.

```text
:) runreveal detections create
Detection name: my-detection
Description: example for the docs.
Categories (comma separated): aws, signal
Severity: Low
Risk Score (number): 10
ATT&CK classification: collection
Enabled: true
Query Type: sql


Detection Created:
        my-detection.yaml
        my-detection.sql

:) 
```

--------------------------------

### Example exported detection files (SQL and YAML)

Source: https://docs.runreveal.com/detections/detection-as-code/export-detections

Shows the two files generated for each exported detection: a SQL query file and a YAML configuration file. The SQL query uses placeholders for the time range, and the YAML file references the SQL file and includes metadata such as categories, sourceTypes, schedule, and MITRE attacks.

```sql
:) cat okta-user-suspicious-report.sql 
select * from okta_logs where
  eventType='user.account.report_suspicious_activity_by_enduser'
  and receivedAt > {from:DateTime} and receivedAt < {to:DateTime}%
```

```yaml
:) cat okta-user-suspicious-report.yaml
name: okta-user-suspicious-report
displayName: Okta User Reported Suspicious Activity
description: Suspicious activity reported by end user
file: okta-user-suspicious-report.sql
categories:
- signal
- okta
sourceTypes:
- okta
schedule: "*/15 * * * *"
notificationNames: []
mitreAttacks:
- initial-access
severity: ""
riskScore: 0
```

--------------------------------

### Slack bot example prompts

Source: https://docs.runreveal.com/integrations/slack-bot

Example prompts for the RunReveal Slack bot covering investigations, detections, and log exploration.

```text
@RunReveal summarize this alert and suggest next steps
```

```text
Who authenticated from unusual geos in the last 6 hours?
```

```text
Correlate this IP with firewall and identity logs for the past day
```
Tokens:
Raw