Cortex XSOAR requires the following software and hardware. Ensure you meet all minimum system requirements.
A WebSocket communications protocol is used in Cortex XSOAR for bi-directional data transfer between the client browser and the server. Verify that the Websocket protocol is allowed on your network, including for proxies.
Linux kernel 5.2 and specific later versions include a bug that may cause XSOAR to panic on x64 platforms due to corrupted memory. Therefore, make sure if XSOAR is running on kernel version 5.3 and later, one of the following fixed kernel versions is used:
5.3.15 and later
5.4.2 and later
5.5 and later
You can identify your kernel version by running the
uname -a or
uname -r command.
Cortex XSOAR Server
Cortex XSOAR server has specific operating system and hardware requirements.
It is recommended that you disable swap for consistent performance.
It is recommended that you use a dedicated server to run Cortex XSOAR and not run additional programs or software on the machine. If you run additional programs on the machine, performance will be affected.
You can deploy Cortex XSOAR on the following operating systems and must meet the minimum hardware requirements:
7.x, 8.0, 8.1, 8.2, 8.3, 8.4
Centos 8.x reached End of Life (EOL) on December 31, 2021, and is no longer a supported operating system. If you are running Centos 8.x, we recommend moving to Centos 7.x or another supported operating system.
Dev Environment Minimum
8 CPU cores
16 CPU cores
1TB SSD with minimum 3k dedicated IOPS
If your hard drive is partitioned, we recommend a minimum of 450GB for the /var partition for the development environment, and 900GB for the /var partition for the production environment.
When deploying Cortex XSOAR with BoltDB, we recommend a limit of 1 million indicators for the development environment and 5-7 million indicators for the production environment. If you will have more indicators, we recommend using Elasticsearch.
Cortex XSOAR requires Docker or Podman for container management. Cortex XSOAR installs either Docker or Podman automatically based on your operating system. IPv4 forwarding is required.
You may need to take additional steps to set up Docker or Podman, depending on your operating system.
Podman, by default, uses the
$HOME/.local/share/containers/storage directory, and we recommend reserving 150GB for the /home partition.
Manually Install Docker.
RHEL v7 or CentOS v7
You need Mirantis Container Runtime (formerly Docker Engine - Enterprise) or Red Hat's Docker distribution to run specific Docker-dependent integrations and automations. For more information see Install Docker Distribution for Red Hat on Cortex XSOAR.
Cortex XSOAR supports the following web browsers:
95.x and later
93.x and later
13.x and later
It is always recommended to install the latest version.
You need to allow the following URLs for Cortex XSOAR to operate properly.
Unit42 Intel Inventory (TIM license)