SOAR platform utilization guidelines
The following sections describe utilization.
CPU utilization guidelines
With the number of CPUs held constant, CPU utilization increases linearly as the number of users increase, eventually resulting in a CPU bottleneck.
Adding CPUs at the appropriate time, such as 2 additional CPUs at 50 users, maintains an acceptable steady-state CPU utilization of 25-35% while leaving room for short-term spikes.
- Response time degrades as the CPUs become busier. CPU utilization that is consistently greater than 70% places users at risk of experiencing major performance degradation and is an indication that administrators should consider adding processors (cores) to the SOAR appliance.
- Short-lived spikes in CPU utilization as a result of bursts of activity or expensive end-user actions are normal. Sustained, high CPU utilization is cause for alarm. These sizing guidelines take the inevitable CPU spikes into consideration by recommending configurations that result in average, steady-state CPU utilization of 30% or lower, leaving room for bursts of activity.
SOAR platform memory guidelines
Insufficient memory causes performance degradation as the operating system is forced to swap data to disk and/or initiate frequent garbage collection.
The following table indicates the minimum amount of RAM recommended based on number of active users and incidents per incident rates. These recommendations consider memory requirements for the operating system, SOAR Platform, Elasticsearch, PostgreSQL, and other Resilient® services.
| Active Users | Typical Rate | Moderate Rate | Heavy Rate |
|---|---|---|---|
| 1-25 | 16GB | 16GB | 16GB |
| 26-50 | 16GB | 24GB | 64GB |
| 51-75 | 16GB | 48GB | 64GB |
| 76-100 | 24GB | 64GB | 80GB |
SOAR platform Disk I/O
Disk writes averaged about 24/sec during the 100-user, heavy rate automation workload test, with a range of 5-39.
The following graph shows that the disk did not have a large impact on performance during the tests.
SOAR platform disk space guidelines
In tests, workloads at a typical rate results in each user consuming the equivalent of 600MB of disk space per year. For the moderate and heavy rates, each user consumed 1GB and 1.4GB of disk space per year, respectively.
It is important to note that disk space can vary substantially, depending on workload. For example, an organization that relies heavily on attachments would consume disk space at a much greater rate than one that does not rely attachments. Administrators should make sure to account for this when configuring storage size.
The following table shows disk space consumed per year.
| Active Users | Typical Rate | Moderate Rate | Heavy Rate |
|---|---|---|---|
| 1-25 | up to 15GB | up to 25GB | up to 35GB |
| 26-50 | up to 30GB | up to 50GB | up to 70GB |
| 51-75 | up to 45GB | up to 75GB | up to 105GB |
| 76-100 | up to 60GB | up to 100GB | up to 140GB |