Elastic Fleet Standalone Node

[alveare1]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8 to 16 depending on node

RAM

16 or 32gb

Storage for /

512

Storage for /nsm

512

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

An Elastic Fleet Standalone Node is ideal when there is a large number of Elastic endpoints deployed.

What is the difference between this and a receiver node?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

https://docs.securityonion.net/en/2.4/architecture.html#elastic-fleet-standalone-node and https://docs.securityonion.net/en/2.4/architecture.html#receiver-node

[alveare1]

I have read this. I am still not understanding why I would use one vs the other in a distributed deployment.

What defines an elastic endpoint?

Thank you for your time

[cm-ops]

The reciever node is for pipeline redundancy in case something happens to the manager, it will still recieve logs, queue them in a Redis queue so your search nodes can pull and process data in the pipeline. The standalone fleet server will manage elastic agents deployed to endpoints, taking some load from the manager in managing the endpoints.

Your endpoints that have an elastic agent deployed to will be your elastic endpoints.