System requirements for Elastic Security "All-in-One" pilot deployment

Elastic Security SIEM
1

Hello everyone,

My company is planning a pilot project to test Elastic Security (including Elasticsearch, Kibana, Logstash, and Fleet). We are also looking into integrating it with various third-party services.

For this testing phase, we intend to deploy the entire stack on a single machine (All-in-One setup). Could you please provide recommendations regarding the system requirements? Specifically, I would appreciate guidance on:

  • CPU: Recommended number of cores (vCPU).

  • RAM: Minimum and recommended memory allocation for a stable environment.

  • Storage: Recommended disk space and type (SSD/NVMe).

Thank you in advance for your help!

2

Let’s say, for 10 log sources with different integrations, 20 vCPU, 32gb RAM, 750gb NVMe SSD is the recommended baseline. You can go bigger if you can/want. Me and my team did it with almost this same requirements, but with each machine of their own in the stack.

1 Like
3

Can you tell me if it will be possible to implement the placement of SIEM in our infrastructure based on SAS disks?

4

I would strongly recommend that you use SSD disks as both indexing and querying in Elasticsearch can be very I/O intensive, especially at higher data volumes. NVMe SSD is ideal but SAS SSDs might also work. If you are considering using HDD I would strongly recommend against that.

1 Like