Deployment Scenarios - What is considered low throughput?

[Chrisputer]

Simple questions from the docs but it doesn't define what low throughput is? Since this is used in enterprise environments and we're getting used to seeing 100Gbps throughputs in datacenters... would that mean VERY low throughputs be less than 100mbps or less than 1gbps.

For example, I'm only needing this for my office which is like 75 computer and about 20 servers (VM and Metal) in total. I have everything in their own VLANs and they have to go through my PA Firewall to get to other machines. This is where I will have the most traffic that needs to be monitored. I'm looking at 1gbps at most during backups at 1AM or so. I have a machine with nothing but NVMe for storage.

Yes, I have searched for this answer and found nothing.

[isaacgolding]

Id think that low throughput is a variable answer. Your "low" is very high for me. My network of 75 devices has an average traffic level of 10mbps with sporadic spikes up into the the very low hundreds. It might help more if you ask a different/more specific question.

[reyesj2]

I would reference the docs. Very good estimates on what the hardware requirements are for your size network.
https://docs.securityonion.net/en/2.3/hardware.html?highlight=hardware#cpu