> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/system-requirements/hardware-requirements.md). # Hardware requirements Review hardware requirements for installing and running Cortex XSOAR 8.14 On-prem. The Cortex XSOAR tenant has specific minimum VM hardware requirements depending on the scale. {% hint style="info" %} ### Important A hypervisor host running VMs must have sufficient hardware resources to support all Cortex XSOAR VMs you plan to run. Cortex XSOAR supports a single-node (standalone) deployment or a three-node cluster deployment. A two-node configuration is not supported. Each VM (node) in a cluster must have the same resources. For example, a 3-VM cluster planned to run on a host must have at least 3 times the listed specs for memory, CPU cores, and storage. Leave additional space for overhead virtualization operations. To fully leverage High Availability, deploy each VM on a different hypervisor. This ensures that the other VMs continue to operate if one hypervisor fails. Multiple network adapters are currently not supported. {% endhint %} The following requirements apply to a single node (standalone), or each node in a cluster. | Component | Extra-small scale | Small scale | Medium scale | Large scale | | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | | CPU per VM | 8 CPU cores | 16 CPU cores | 32 CPU cores | 48 CPU cores | | Memory per VM | 32 GB RAM | 64 GB RAM | 128 GB RAM | 192 GB RAM | | Storage per VM | 256 GB boot disk plus a separate 775 GB data disk. These disks must be SSDs. | 256 GB boot disk plus a separate 775 GB data disk. These disks must be SSDs. | 256 GB boot disk plus a separate 1.3 TB data disk (1 TB = 1024 GB). These disks must be SSDs. | 256 GB boot disk plus a separate 1.8 TB data disk (1 TB = 1024 GB). These disks must be SSDs. | | Performance benchmark | Up to 100 incidents per day / up to 10 incidents per hour | Up to 200 Phishing playbook runs per hour | 200 - 400 Phishing playbook runs per hour | Up to 650 Phishing playbook runs per hour | | (Optional) Backup and restore disk space in the NFS server | 1 TB | 1 TB | 3 TB | 3 TB | {% hint style="info" %} Performance benchmark values for running the Phishing playbook are for a single node. This value can vary according to playbook size and complexity. {% endhint %} {% hint style="warning" %} The extra-small sizing scale should be used only by main, child, and development tenants that do not have the Threat Intel Management feature enabled. This sizing should be used for tenants that don't need to run a high volume of playbooks (subject to service limits). {% endhint %} ### Migration For migration from Cortex XSOAR 6 to 8, storage for data migrated from BoltDB, including demisto.db, the latest partition to transfer, and data folders under `/var/lib/demisto`: * /artifacts * /attachments * /downloads * /ml * /images | Extra-small scale | Small scale | Medium scale | Large scale | | ----------------- | ----------- | ------------ | ----------- | | 250 GB | 250 GB | 450 GB | 600 GB | For migration from Cortex XSOAR 6 to 8, storage for data migrated from Elasticsearch, including: * The sum of all index sizes for non-partitioned indices * The sum of all partitioned indices for a specific month (with YYYYMM suffixes, for example, 202411) * Data folders under /var/lib/demisto: * /artifacts * /attachments * /downloads * /ml * /images | Extra-small scale | Small scale | Medium scale | Large scale | | ----------------- | ----------- | ------------ | ----------- | | 340 GB | 340 GB | 590 GB | 800 GB | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/system-requirements/hardware-requirements.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.