Drongo

The drongo command group manages connection health, mTLS authentication, outbox telemetry relay, and behavioral detection rules with the centralized Drongo intelligence engine.

Available actions

Action	Description
`status`	Display pairing status, auth mode, transport, and outbox telemetry metrics.
`test`	Verify reachability and credentials against Drongo HTTP endpoints or Kafka brokers.
`dispatch`	Drain pending context events from the outbox queue to Drongo.
`sync-feed`	Fetch Drongo behavioral rules feed and immediately deploy to sensors.
`token`	Generate a one-time enrollment pairing token (valid for 15 minutes).
`enroll`	Issue mTLS credentials and activate pairing directly on the local machine.

To inspect group options, syntax, and examples directly in the terminal, run suricatavel drongo help.

Inspect integration status

View connection details, mTLS pairing state, transport mode, and telemetry counters:

suricatavel drongo status

Test connectivity

Verify reachability and authentication against the configured Drongo destination:

suricatavel drongo test

Drain outbox queue

Dispatch pending telemetry records from the local database outbox to Drongo:

# Process pending records with custom batch limits
suricatavel drongo dispatch --limit=100 --max-attempts=5 --time-budget=50

`dispatch` options

--limit: Maximum number of records to dispatch per cycle (default: configured batch size).
--max-attempts: Maximum retry attempts before marking records as failed (default: 5).
--time-budget: Maximum seconds to spend draining outbox records (0 for no limit, default: 50).

Synchronize behavioral rules

Trigger an immediate fetch of behavioral rules published by Drongo and deploy them to active sensors:

suricatavel drongo sync-feed

Generate pairing token

Generate a one-time password (OTP) token for a remote Drongo node to sign its CSR via POST /api/v1/drongo/pki/enroll:

suricatavel drongo token

Enroll Drongo node

Issue mTLS certificates signed by Suricatavel’s internal Root CA and activate pairing:

# Automatically generate private key, signed certificate, and Root CA in a directory:
suricatavel drongo enroll --out-dir=/etc/drongo/certs

# Sign an existing CSR file:
suricatavel drongo enroll --csr=/etc/drongo/drongo.csr --cert-out=/etc/drongo/drongo.crt --force

`enroll` options

--out-dir: Directory where drongo.crt, drongo.key, and ca.crt will be saved.
--csr: Path to an existing CSR file for direct signing.
--cert-out: Target path for the signed mTLS client certificate.
--key-out: Target path for the generated client private key.
--ca-out: Target path for the Root CA certificate chain.
--validity: Validity period in days (default: 365).
--force: Overwrite existing files if they already exist.