Distributed Deployment Capacity and sizing planning

[P4R4D0x98]

Hello everyone,

What are the recommended specifications for CPU cores, RAM, and storage for each node (sensor, master, search) in a distributed Security Onion deployment for every 100Mbps monitor network traffic added to sensor how much hardware do I need to add as the documentation is a bet vague? Additionally, what is the expected percentage of bandwidth usage between the sensors and the master node in relation to the monitor traffic?

Thank you in advance

[dougburks]

Have you reviewed the Hardware Requirements section of the documentation?

https://docs.securityonion.net/en/2.3/hardware.html#manager-node-with-separate-search-nodes

https://docs.securityonion.net/en/2.3/hardware.html#search-node

https://docs.securityonion.net/en/2.3/hardware.html#sensor-hardware-considerations

https://docs.securityonion.net/en/2.3/hardware.html#cpu