Build from Source


C++ CompilerC++17 Support requiredVAST is tested to compile with any the following compilers:
  • GCC >= 8.0
  • Clang >= 8.0
  • Apple Clang >= 9.1
CMake>= 3.11Cross-platform tool for building, testing and packaging software.
CAF>= 0.17.6Implementation of the actor model in C++. (Bundled as submodule.)
FlatBuffers>= 1.11.0Memory-efficient cross-platform serialization library.
Apache Arrow>= 1.0.0Required for the default Apache Arrow export format and for the Apache Arrow table slice type. Apache Arrow support can be explicitly disabled by configuring with --without-arrow. Note that this changes the default behavior of VAST.
yaml-cpp>= 0.6.2Required for reading YAML configuration files.
simdjson>= 0.6Required for high-performance JSON parsing.
spdlog>= 1.5Required for logging.
fmt>= 5.2.1Required for formatted text output.
libpcapRequired for PCAP import, export, and pivoting to and from PCAP traces.
brokerRequired to build zeek-to-vast bridge. (Bundled as submodule.)
DoxygenRequired to build documentation for libvast.
PandocRequired to build manpage for VAST.

Source Build

Building VAST involves the following steps:

  1. Download the latest release or clone the repository recursively:
    git clone --recursive
  2. Configure the build, either with our configure wrapper script or manually with CMake:
    cd vast
  3. Build the executable:
    cmake --build build --target all
  4. Run the tests to verify everything works as expected:
    cmake --build build --target test
    cmake --build build --target integration
  5. Install VAST system-wide or into your configured prefix:
    cmake --build build --target install

Run ./configure --help to see the list of available build configuration options.


We provide Nix expressions to create a localized build environemnt with dependencies. Run nix-shell in the top-level directory for a deterministic build environment.

You can use the same scaffold to build and install VAST directly into the Nix Store and add it to the Nix profile. To do so, invoke nix-env in the top-level directory:

nix-env -f default.nix -i