View the hardware requirements when installing Cortex XSOAR On-prem.
The Cortex XSOAR tenant has specific minimum VM hardware requirements depending on the scale.
Important
A hypervisor host running VMs must have enough hardware resources to support all Cortex XSOAR VMs you plan to run on.
Cortex XSOAR supports a single node (standalone) or a three-node cluster deployment. A two-node configuration is not supported.
Each VM (node) in a cluster must have the same resources. For example, a 3 VM cluster planned to run on a host must have at least 3 times the listed specs for memory, CPU cores, and storage. Leave additional space for overhead virtualization operations.
To fully leverage High Availability, deploy each VM on a different hypervisor. This ensures that the other VMs continue to operate if one hypervisor fails.
Multiple network adapters are currently not supported.
The following requirements apply for a single node (standalone), or each node in a cluster.
Component | Extra-small scale | Small scale | Medium scale | Large scale |
|---|---|---|---|---|
CPU per VM | 8 CPU cores | 16 CPU cores | 32 CPU cores | 48 CPU cores |
Memory per VM | 32 GB RAM | 64 GB RAM | 128 GB RAM | 192 GB RAM |
Storage per VM | 256 GB boot disk plus a separate 775 GB data disk. These disks must be SSDs. | 256 GB boot disk plus a separate 775 GB data disk. These disks must be SSDs. | 256 GB boot disk plus a separate 1.3 TB data disk (1 TB = 1024 GB). These disks must be SSDs. | 256 GB boot disk plus a separate 1.8 TB data disk (1 TB = 1024 GB). These disks must be SSDs. |
Performance benchmark NoteThe benchmark values for running the Phishing playbook are for a single node. This value can vary according to playbook size and complexity. | Up to 100 incidents per day / up to 10 incidents per hour | Up to 200 Phishing playbook runs per hour | 200 - 400 Phishing playbook runs per hour | Up to 650 Phishing playbook runs per hour |
(Optional) Backup and restore disk space in the NFS server | 1 TB | 1 TB | 3 TB | 3 TB |
Notes | The extra-small sizing scale should be used only by main, child, and development tenants that do not have the Threat Intel Management feature enabled. This sizing should be used for tenants that don't need to run a high volume of playbooks (subject to service limits). | |||
For migration from Cortex XSOAR 6 to 8, storage for data migrated from BoltDB, including demisto.db, the latest partition to transfer, and data folders under
| 250 GB | 250 GB | 450 GB | 600 GB |
For migration from Cortex XSOAR 6 to 8, storage for data migrated from Elasticsearch, including:
| 340 GB | 340 GB | 590 GB | 800 GB |