Hello everyone, My company is planning a pilot project to test Elastic Security (including Elasticsearch, Kibana, Logstash, and Fleet). We are also looking into integrating it with various third-party services. For this testing phase, we intend to deploy the entire stack on a single machine (All-i…

Let’s say, for 10 log sources with different integrations, 20 vCPU, 32gb RAM, 750gb NVMe SSD is the recommended baseline. You can go bigger if you can/want. Me and my team did it with almost this same requirements, but with each machine of their own in the stack.

Can you tell me if it will be possible to implement the placement of SIEM in our infrastructure based on SAS disks?

I would strongly recommend that you use SSD disks as both indexing and querying in Elasticsearch can be very I/O intensive, especially at higher data volumes. NVMe SSD is ideal but SAS SSDs might also work. If you are considering using HDD I would strongly recommend against that.

Discuss the Elastic Stack

System requirements for Elastic Security "All-in-One" pilot deployment

Elastic Security SIEM

Topic		Replies	Views
System requirements for ELK SIEM Elastic Security elastic-stack-monitoring , docker	2	1302	August 6, 2021
Infrarelated query Elastic Security	3	242	July 5, 2023
Sizing Elastic Stack for a PoC (security use case) Elastic Security	7	667	February 11, 2024
Elastic SIEM - Hardware specs Elastic Security	4	282	February 5, 2025
Sizing Parameters for deploying SIEM SIEM	1	520	May 14, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

System requirements for Elastic Security "All-in-One" pilot deployment

Related topics