> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/system-requirements/elasticsearch-system-requirements.md).

# Elasticsearch System Requirements

The following provides the system requirements for implementing Cortex XSOAR with Elasticsearch.

#### Elasticsearch Server

The information in the following table is per Elasticsearch node, and assumes that the node is assigned all Elasticsearch node roles (for example, which data is written to disk and when).

| Component | Dev Environment Minimum | Production Minimum                        |
| --------- | ----------------------- | ----------------------------------------- |
| CPU       | 8 CPU Cores             | 16 CPU cores                              |
| Memory    | 16 GB RAM               | 32 GB RAM                                 |
| Storage   | 250 GB SSD              | 500 GB SSD with minimum 3k dedicated IOPS |

{% hint style="info" %}

### Note

You must ensure that between the Elasticsearch and Cortex XSOAR servers, and between Elasticsearch servers, latency should not exceed 100 MS. Latency that exceeds 100 MS can cause serious performance degradation.
{% endhint %}

#### Supported Elasticsearch Versions

{% hint style="info" %}

### Note

Make sure the latest Cortex XSOAR version is installed.
{% endhint %}

| Search Engine | Supported Versions                                                                              |
| ------------- | ----------------------------------------------------------------------------------------------- |
| Elasticsearch | <ul><li>7.4 to 7.17 including minor versions</li><li>8.6.1</li><li>8.11</li></ul>               |
| OpenSearch    | <ul><li>1.0 to 1.2 including minor versions</li><li>2.0.0</li><li>2.6.0</li><li>2.9.0</li></ul> |

#### Elasticsearch in the Cloud

Cortex XSOAR supports using Elasticsearch with all the major cloud service providers, Amazon Web Services, Azure, and Google Cloud Platform.

{% hint style="info" %}

### Note

For OpenSearch, ensure that the AWS instance type supports a maximum HTTP payload of 100 MB, which is sufficient for production usage. For more information, see [Amazon OpenSearch Instance Limits](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/limits.html#network-limits).
{% endhint %}

You can use Elasticsearch as a service provided by your cloud provider, or install Elasticsearch on a server in the cloud.

The hardware requirements for Elasticsearch in the cloud are similar to those posted above. To achieve this with your cloud provider, Cortex XSOAR recommends you use the machines based on your intentions. For example:

* When the Elasticsearch server functions as a data node, we recommend you use Storage optimized machines, such as the AWS i3.2xlarge machine. Alternatively, you can use a memory-optimized machine, such as the AWS r3.2xlarge machine.
* When the Elasticsearch server is used for any other function (such as master mode), we recommend that you use a Compute-optimized machine, such as the AWS c4.2xlarge machine.

You can configure your cloud environment to work with different regions provided that you can maintain the minimum latency requirements noted above.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/system-requirements/elasticsearch-system-requirements.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.