...
Snare Central is capable of running on a variety of hardware configurations, from laptops, right up to Linux partitions on mainframe systems and VMs. Hardware requirements are significantly dependent on the volume of audit received by Snare Central, and the type and number of audit objectives defined. As an appliance-style solution, expanding storage post-install is supported, however, It is recommended that storage allocation is sized with a view towards long term requirements.
However, in order for Snare Central to be in a supported configuration, the following requirements MUST be followed. There should be no deviations from the specifications listed below.Systems need to be sized to meet the expected workload the system will need to manage. Some key aspects to use when designing your install are:
- How many agents and systems will be sending logs to the system
- What is the expected Event per Second rate of the environment (EPS)
- What is the data retention needs of the system ie 30 days, 6 months, 1 year, 3 years 7 years as this can affect the long term storage strategy of the disk sizing and backup and archival process.
- Is the system being used as a store and forward thats mostly reflector based or will there be reports and queries performed on the system. The more reporting, alerting and queries run the more cpu, memory and disk IO will be used so the overall load on the system will be higher. So to support the extra load the system sizing may need to be increased.
- Disk is often the slowest part of a computer system. As Snare Central is centralised logging system it is very IO intensive. Larger environment with higher EPS rates will need enterprise grade disk subsystems with fibre channel attached disks and/or SSD/NVME/Flash based storage to keep up with the IO demands.
- When installing Snare Central consider the platform that it is being installed on. Can the environment support the expected load. Some VMware systems are oversubscribed and may struggle to support the additional load. Due to the nature of a logging system it will consume system resources on a 24/7 basis. So make sure the system can scale and use the configured resources when expected. It may have peek system usage during high event loads such as:
- higher than normal firewall log activity
- user created events from logins/logoffs for staff and users
- malware infections may generate higher than normal eps rates
- malicious users that will trigger audit logging and collection
- Ensure you have a backup strategy in place to keep your logs safe from system hardware failures and disk corruptions.
The below sizing details are provided to help design the Snare Central installation. Depending on your expected usage it may need to be adjusted usually adding more resources to cater for the additional workloads. If you have questions on your needs then please talk with our sales and consulting team to assist.
| Info | ||
|---|---|---|
| ||
This configuration may also be appropriate for sites with a medium number of source systems, that just want to use Snare Central for the reflector functionality, and do not require any local reporting or data analysis. Reflector-only sites with high volumes of incoming data, or a count of source agents that is in the upper quarter of the 'larger configuration' maximum, may need to increase the CPU, disk and memory capacity to cope with the additional load. |
...
| Info | ||
|---|---|---|
| ||
Small environment up to 500 systems (<= 1,000 EPS)
For large to very large environments please contact your Snare Sales representative. |
| Info | ||
|---|---|---|
| ||
Moderate environment up to 2,000 systems (<= 5,000 EPS)
|
| Info | ||
|---|---|---|
| ||
Larger environment up to 5,000 systems (<= 10,000 EPS)
|
| Info | ||
|---|---|---|
| ||
Larger environment up to <= 25,000 EPS
For large to very large environments please contact your Snare Sales representative. |
...
| Info | ||
|---|---|---|
| ||
Where Snare Central is used just for Agent Management then the disk space requirements can be reduced as the system is not collecting significant numbers of logs
Note: If there is less than 350GB of disk allocated to the system, it will default to a single partition AMC configuration. Only environments using 350GB 400GB or more will use the new disk layouts as per Appendix B. |
...
| Info | ||
|---|---|---|
| ||
A Snare Advanced Analytics installation dashboards will generally require more resources than a baseline Snare Central install. The following additions should me made to any baseline installation:
|
...