Hardware requirements

View hardware requirements for Cortex XSOAR 8.10 On-prem.

The Cortex XSOAR tenant has specific minimum VM hardware requirements depending on the scale.

Important

A hypervisor host running VMs must have sufficient hardware resources to support all Cortex XSOAR VMs you plan to run.

Cortex XSOAR supports a single-node (standalone) deployment or a three-node cluster deployment. A two-node configuration is not supported.

Each VM (node) in a cluster must have the same resources. For example, a 3-VM cluster planned to run on a host must have at least 3 times the listed specs for memory, CPU cores, and storage. Leave additional space for overhead virtualization operations.

To fully leverage High Availability, deploy each VM on a different hypervisor. This ensures that the other VMs continue to operate if one hypervisor fails.

Multiple network adapters are currently not supported.

The following requirements apply to a single node (standalone), or each node in a cluster.

Component	Extra-small scale	Small scale	Medium scale	Large scale
CPU per VM	8 CPU cores	16 CPU cores	32 CPU cores	48 CPU cores
Memory per VM	32 GB RAM	64 GB RAM	128 GB RAM	192 GB RAM
Storage per VM	256 GB boot disk plus a separate 775 GB data disk. These disks must be SSDs.	256 GB boot disk plus a separate 775 GB data disk. These disks must be SSDs.	256 GB boot disk plus a separate 1.3 TB data disk (1 TB = 1024 GB). These disks must be SSDs.	256 GB boot disk plus a separate 1.8 TB data disk (1 TB = 1024 GB). These disks must be SSDs.
Performance benchmark	Up to 100 incidents per day / up to 10 incidents per hour	Up to 200 Phishing playbook runs per hour	200 - 400 Phishing playbook runs per hour	Up to 650 Phishing playbook runs per hour
(Optional) Backup and restore disk space in the NFS server	1 TB	1 TB	3 TB	3 TB

Performance benchmark values for running the Phishing playbook are for a single node. These values can vary according to playbook size and complexity.

The extra-small sizing scale should be used only by main, child, and development tenants that do not have the Threat Intel Management feature enabled.

This sizing should be used for tenants that don't need to run a high volume of playbooks (subject to service limits).

Migration

For migration from Cortex XSOAR 6 to 8, storage for data migrated from BoltDB, including demisto.db, the latest partition to transfer, and data folders under /var/lib/demisto:

• /artifacts
• /attachments
• /downloads
• /ml
• /images

Extra-small scale	Small scale	Medium scale	Large scale
250 GB	250 GB	450 GB	600 GB

For migration from Cortex XSOAR 6 to 8, storage for data migrated from Elasticsearch, including:

• The sum of all index sizes for non-partitioned indices
• The sum of all partitioned indices for a specific month (with YYYYMM suffixes, for example, 202411)
• Data folders under /var/lib/demisto:

  • /artifacts
  • /attachments
  • /downloads
  • /ml
  • /images

Extra-small scale	Small scale	Medium scale	Large scale
340 GB	340 GB	590 GB	800 GB