The operational task
Offline operation needs verified installation, local telemetry, storage, clock handling, and a controlled update process.
What the implementation supports
Core local modules can operate without cloud analysis. Optional external analysis, dashboards, remote notifications, and live intelligence have separate connectivity requirements.
Integration and limits
An air gap is not complete protection. Verify enabled features and dependencies in the intended environment and document how binaries, rules, and policies are imported.
Check collector wiring, the current event schema, and the enforcing component before relying on a response. Preserve the original event and verify the result on your actual deployment. An emitted alert does not prove that the initiating operation was stopped.