SOAR sizing guidelines conclusion
An organization that sends incidents at a typical rate can support up to 25 active users on the minimum recommended configuration (4 CPUs, 16GB RAM, 150 GB disk). As the number of users and/or incidents per day increases, so does response time. If response time degrades to undesirable levels, administrators can use this document as a guideline and add resources to improve response time.
Variations in workload distribution and/or frequency affect resource utilization. Some incidents
are more resource-intensive than others, so resource utilization is not only dependent on number of
users or incidents, but also on the types of incidents that are being sent to the server. As such,
administrators should expect to use the information provided as a starting point, continually
monitor performance, and adjust resources as necessary. For example:
- Disk space can vary substantially. For example, an organization that relies heavily on attachments can consume a lot more disk space than other organizations.
- Resource utilization can vary substantially when using timer events in workflows. For example, a timer that triggered a script to update an incident field every 15 minutes had minimal impact on performance, but when 1200 of these timers were scheduled concurrently, CPU utilization increased by 40% on a minimum configuration.
- Apps can have a significant impact on system performance, and resource utilization varies depending on their usage of the REST API.