Rockfish NDR — deployment scripts
=================================

This directory bundles the Rockfish NDR deployment toolkit: the systemd units,
cron examples, and helper scripts needed to run a sensor. The active systemd
units are also installed to /lib/systemd/system by the package; the copies here
are the editable reference source.

Files
-----
  rockfish.service            systemd unit for the detection engine
                              (`rockfish detect`): reads Suricata EVE, ingests
                              to Parquet, runs OCCAM / odometry / hunt.
  rockfish-report.service     systemd unit for the reporting service
                              (`rockfish report --serve`): builds and serves
                              the HTML dashboard.
  rockfish-rule-update.cron   /etc/cron.d example — daily `rockfish rule update`
                              (pull latest ruleset + hot-reload Suricata).
  cron-rules-refresh.sh       Alternative weekly curated refresh via
                              rockfish-curator / rockfish-ruleset.
  install-service.sh          Interactive installer: creates the rockfish user
                              and directories and installs the binary + units.

Quick start
-----------
  # enable the two services (units are already in /lib/systemd/system)
  sudo systemctl enable --now rockfish rockfish-report

  # daily rule refresh
  sudo cp /opt/rockfish/scripts/rockfish-rule-update.cron \
          /etc/cron.d/rockfish-rule-update
