Hardware requirements for the Central Node server with the event chain scanning enabled
The hardware requirements for the Central Node server with the event chain scanning feature enabled and functionality being used are listed in the table below.
Hardware requirements for the server with the Central Node component when using KEDR functionality
Maximum number of hosts with the Endpoint Agent component | Minimum RAM (GB) | Minimum number of logical cores at 3 GHz | First disk subsystem (RAID 1 or RAID 10) | Second disk subsystem (RAID 10) | |||||
|---|---|---|---|---|---|---|---|---|---|
ROPS (read operations per second) | WOPS (write operations per second) | Disk array size (TB) | The number of disks in the array | ROPS (read operations per second) | WOPS (write operations per second) | Disk array size (TB) | |||
1000 | 64 | 8 | 100 | 1000 | 1 | 4 | 300 | 300 | Up to 7.2 TB |
3000 | 80 | 12 | 100 | 1000 | 1 | 4 | 700 | 750 | |
5000 | 96 | 16 | 100 | 1000 | 1 | 4 | 1000 | 900 | |
10,000 | 144 | 24 | 100 | 1000 | 1 | 4 | 2000 | 1200 | |
15,000 | 192 | 36 | 100 | 1000 | 1 | 4 | 2000 | 1600 | |
Hardware requirements for the server with the Central Node component when using KATA and KEDR functionality
Maximum number of hosts with the Endpoint Agent component | Maximum number of email messages per second | Maximum volume of traffic from SPAN ports on the server with the Central Node component | Maximum volume of traffic from SPAN ports on servers with the Sensor component (Mbps) | Minimum RAM (GB) | Minimum number of logical cores at 3 GHz | First disk subsystem (RAID 1 or RAID 10) | Second disk subsystem (RAID 10) | ||||
|---|---|---|---|---|---|---|---|---|---|---|---|
ROPS (read operations per second) | WOPS (write operations per second) | Disk array size (TB) | The number of disks in the array | ROPS (read operations per second) | WOPS (write operations per second) | ||||||
1000 | 1 | 200 | Not processed | 96 | 16 | 100 | 1000 | 1.9 | 4 | 300 | 300 |
2000 | 2 | 500 | Not processed | 128 | 28 | 100 | 1000 | 2 | 4 | 500 | 500 |
5000 | 1 | 1000 | Not processed | 160 | 40 | 100 | 1000 | 2 | 4 | 1000 | 600 |
10,000 | 2 | 1000 | Not processed | 224 | 48 | 100 | 1000 | 2 | 4 | 2000 | 800 |
5000 | 5 | Not processed | 2000 | 160 | 32 | 100 | 1000 | 1.9 | 4 | 1000 | 600 |
10,000 | 20 | Not processed | 4000 | 224 | 64 | 100 | 1000 | 1.9 | 4 | 2000 | 800 |
15,000 | 20 | Not processed | 4000 | 288 | 72 | 100 | 1000 | 1.9 | 4 | 2000 | 800 |
15,000 | 20 | Not processed | 7000 | 320 | 104 | 100 | 1000 | 1.9 | 4 | 2000 | 800 |
15,000 | 20 | Not processed | 10,000 | 320 | 144 | 100 | 1000 | 1.9 | 4 | 2000 | 800 |
If you want to use the event chain scanning functionality, the second disk subsystem on the Central Node server must use a solid-state drive (SSD) if at least one of the following conditions is true:
- Your organization has more than 10,000 Endpoint Agent hosts.
- You want to deploy the Central Node component as a cluster.
