Sizing Requirements for High Availability Deployments - Administrator Guide - 6.9 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.9
Creation date
2022-09-29
Last date published
2024-05-22
End_of_Life
EoL
Category
Administrator Guide
Abstract

Information about the sizing requirements for Cortex XSOAR High Availability deployments.

App Servers

Cortex XSOAR recommends you have at least 2 application servers meeting the requirements listed below, as well as a load balancer and shared file system.

Component

Dev Environment Minimum

Production Minimum

CPU

8 CPU cores

16 CPU cores

Memory

16 GB RAM

32 GB RAM

Storage

Note

The storage requirement is irrespective of the file share.

100 GB SSD

250 GB SSD with minimum 1k dedicated IOPS

Note

Depending on the size of your log files, consider increasing this to 500 GB.

File Share Server

Cortex XSOAR recommends your file sharing server meet the following minimum requirements.

Note

  • If you are using Amazon EFS, GCP File Store, or Azure Files, verify that you are only using these systems for your file sharing and not as the database or application servers.

  • The file sharing server must be in the same virtual private cloud as the application servers.

Component

Dev Environment Minimum

Production Minimum

Storage

100 GB SSD

250 GB SSD with minimum 1k dedicated IOPS

Elasticsearch Database Development Configuration

Environment

Number of Nodes

Elastic Node Roles

Minimum

1

Data node

Recommended

3

All three must be data nodes, but can also function as other roles.

Elasticsearch Database Production Configuration

Environment

Number of Nodes

Elastic Node Roles

Minimum

3

All three must be data nodes, but can also function as other roles.

Recommended

6

  • 3 - Data

  • 3 master and 3 coordinating roles

Hardware Requirements

Component

Dev Node Minimum

Production Node Minimum

CPU

8 CPU cores

16 CPU cores

Memory

16 GB RAM

32 GB RAM

Storage

250 GB

500 GB SSD with minimum 3k dedicated IOPS