Elasticsearch System Requirements - Installation Guide - 6.13 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Installation Guide
Product
Cortex XSOAR
Version
6.13
Creation date
2024-04-15
Last date published
2024-10-09
Category
Installation Guide
Abstract

Review requirements for implementing Cortex XSOAR with Elasticsearch. Each option has specific sizing requirements.

The following provides the system requirements for implementing Cortex XSOAR with Elasticsearch.

Elasticsearch Server

The information in the following table is per Elasticsearch node, and assumes that the node is assigned all Elasticsearch node roles (for example, which data is written to disk and when).

Component

Dev Environment Minimum

Production Minimum

CPU

8 CPU Cores

16 CPU cores

Memory

16 GB RAM

32 GB RAM

Storage

250 GB SSD

500 GB SSD with minimum 3k dedicated IOPS

Note

You must ensure that between the Elasticsearch and Cortex XSOAR servers, and between Elasticsearch servers, latency should not exceed 100 MS. Latency that exceeds 100 MS can cause serious performance degradation.

Supported Elasticsearch Versions

Note

Make sure the latest Cortex XSOAR version is installed.

Search Engine

Supported Versions

Elasticsearch

  • 7.4 to 7.17 including minor versions

  • 8.6.1

  • 8.11

  • 8.12

  • 8.13

OpenSearch

  • 1.0 to 1.2 including minor versions

  • 2.0.0

  • 2.6.0

  • 2.9.0

  • 2.10

  • 2.11

  • 2.12

  • 2.13

  • 2.14

Elasticsearch in the Cloud

Cortex XSOAR supports using Elasticsearch with all the major cloud service providers, Amazon Web Services, Azure, and Google Cloud Platform.

Note

For OpenSearch, ensure that the AWS instance type supports a maximum HTTP payload of 100 MB, which is sufficient for production usage. For more information, see Amazon OpenSearch Instance Limits.

You can use Elasticsearch as a service provided by your cloud provider, or install Elasticsearch on a server in the cloud.

The hardware requirements for Elasticsearch in the cloud are similar to those posted above. To achieve this with your cloud provider, Cortex XSOAR recommends you use the machines based on your intentions. For example:

  • When the Elasticsearch server functions as a data node, we recommend you use Storage optimized machines, such as the AWS i3.2xlarge machine. Alternatively, you can use a memory-optimized machine, such as the AWS r3.2xlarge machine.

  • When the Elasticsearch server is used for any other function (such as master mode), we recommend that you use a Compute-optimized machine, such as the AWS c4.2xlarge machine.

You can configure your cloud environment to work with different regions provided that you can maintain the minimum latency requirements noted above.