New Distributed Installation

[Eaglerod1978]

I am working on building a distributed deployment and I have the following to monitor. This is my draft plan. Let me know if you think this will work.

• Manager Node: This is the central node that manages configurations and controls the other nodes. It usually also serves as the main interface for analysts.
	○ CPU: 8 cores
	○ RAM: 32GB
	○ Disk: 1TB SSD for fast access and configuration storage

• Search Nodes (x2): These nodes are responsible for handling search queries. They usually have Elasticsearch, Logstash, and Kibana (ELK stack) installed. The more search nodes you have, the better your search performance will be.
	○ CPU: 8 cores each
	○ RAM: 64GB each
	○ Disk: 2TB SSD each for fast search and indexing

• Forward Nodes (Sensors) (x2): These nodes are responsible for capturing network traffic and forwarding metadata to the manager node. They are usually deployed at various points in your network to capture traffic.
	○ CPU: 6 cores each
	○ RAM: 16GB each
	○ Disk: 500GB SSD each for temporary storage and forwarding

• Receiver Node: This node is responsible for receiving logs and data from forward nodes and other data sources. It then forwards this data to the search nodes for indexing.
	○ CPU: 8 cores
	○ RAM: 32GB
	○ Disk: 2TB SSD for receiving and temporarily storing data before forwarding to Search Nodes

Total Need
CPU: 44 Cores
RAM: 224 MB
Disk: 10 TB of Disk Space

This is based on monitoring
200-220 Servers
50 Syslog Devices - (Proofpoint, Mitel, Firewalls, Switches, IoT etc)
40 IT Computers
99 Meraki Networks

[TOoSmOotH]

Receiver node doesn't really need a lot of disk space as most things happen in memory. Depending on your pcap retention requirements you space might be a little light on the forward nodes.

[EugeneFenko]

Hello @TOoSmOotH , please let me know

• Any option for configuring Receiver node as primary node for ingest logs and disable Manager node for receive logs?
• Any option for config cluster of Manager node for multi-site deployment?

[dougburks]

@EugeneFenko Please start a new discussion rather than replying to somebody's else discussion.