For on premise log sources, Anomali software is deployed on the SIEM system or on another system in your local network. A Universal Link instance connects to Security Analytics on one side and to a SIEM (or other event source) on the other side.

For information about installing Anomali Universal Link in your on premise environment and enabling Suricata, see the Anomali Universal Link Installation Guide.