Cortex XSOAR server has specific operating system and hardware requirements. The following requirements are for both single server and multi-tenant installations unless otherwise specified.
Note the following:
It is recommended that you disable swap (swapoff -a) for consistent performance.
It is recommended that you use a dedicated server to run Cortex XSOAR and not run additional programs or software on the machine. If you run additional programs on the machine, performance will be affected.
A WebSocket communications protocol is used in Cortex XSOAR for bi-directional data transfer between the client browser and the server. Verify that the Websocket protocol is allowed on your network, including for proxies.
Linux kernel 5.2 and specific later versions include a bug that may cause XSOAR to panic on x64 platforms due to corrupted memory. Therefore, make sure if XSOAR is running on kernel version 5.3 and later, one of the following fixed kernel versions is used. You can identify your kernel version by running the
5.3.15 and later
5.4.2 and later
5.5 and later
Note: The version of the Linux kernel you have depends on your Linux distribution.
You can deploy Cortex XSOAR on the following operating systems and must meet the minimum hardware requirements:
8.0, 8.1, 8.2, 8.3, 8.4, 8.5
Centos 8.x reached End of Life (EOL) on December 31, 2021, and is no longer a supported operating system. If you are running Centos 8.x, we recommend moving to Centos 7.x or another supported operating system.
Operating System Git
Cortex XSOAR uses git for all version control commands. By default, the Cortex XSOAR installation includes git and the git files are installed at
You also have the option to use your operating system git. If you are installing Cortex XSOAR for the first time, use the
-git false flag during installation to skip the Cortex XSOAR git installation. If you have already installed Cortex XSOAR with git, you can manually delete the Cortex XSOAR git files, located at
If you do not install Cortex XSOAR git or you delete the Cortex XSOAR git files, Cortex XSOAR will use the default operating system git. The minimum git version must be 2.21.0 or later.
Dev Environment Minimum
8 CPU cores
16 CPU cores
1TB SSD with minimum 3k dedicated IOPS
If your hard drive is partitioned, we recommend a minimum of 450GB for the /var partition for the development environment, and 900GB for the /var partition for the production environment.
When deploying Cortex XSOAR with the Bolt database, we recommend a limit of 1 million indicators for the development environment and 5-7 million indicators for the production environment. If you will have more indicators, we recommend using Elasticsearch.
You may need to take additional steps to set up Docker or Podman, depending on your operating system.
Podman, by default, uses the
$HOME/.local/share/containers/storage directory, and we recommend reserving 150GB for the /home partition.
Manually Install Docker.
You need Mirantis Container Runtime (formerly Docker Engine - Enterprise) or Red Hat's Docker distribution to run specific Docker-dependent integrations and automations. For more information see Install Docker Distribution for Red Hat on Cortex XSOAR.
You need to allow the following URLs for Cortex XSOAR to operate properly.
Unit42 Intel Inventory (TIM license)