> For the complete documentation index, see [llms.txt](https://docs.spyderbat.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.spyderbat.com/installation/spyderbat-event-forwarder.md).

# Install the Spyderbat Event Forwarder

{% hint style="warning" %}
The Event Forwarder requires SIEM forwarding to be enabled on at least one saved query before it will receive events. See [SIEM Forwarding](/concepts/integrations/siem-forwarding.md) to set up the control plane first.
{% endhint %}

The Spyderbat Event Forwarder is an open-source binary ([github.com/spyderbat/event-forwarder](https://github.com/spyderbat/event-forwarder)) that polls the Spyderbat SIEM API and delivers events to your destination. It supports files, stdout, syslog, and HTTP webhooks.

## Deployment options

| Deployment            | When to use                         | Guide                                                                                     |
| --------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------- |
| Helm chart            | Kubernetes environments             | [Helm Chart](/installation/spyderbat-event-forwarder/helm-chart.md)                       |
| Traditional installer | Linux systemd (VM, bare metal, EC2) | [Traditional Installer](/installation/spyderbat-event-forwarder/traditional-installer.md) |

Run only one Event Forwarder instance per organization. Multiple instances each deliver the full event stream, producing duplicates.

For architecture details, see [Spyderbat Event Forwarder](/concepts/integrations/spyderbat-event-forwarder.md).