Host
- One Linux server (a virtual machine is fine). Ubuntu 22.04 or later and Debian 12 or later are tested; other distributions with Docker Engine work.
- Docker Engine 24 or later with Docker Compose v2.
- NVMe or equivalent low-latency storage for the database volume. Spinning disks make search slow.
Sizing
Throughput and storage depend on your telemetry mix. Sysmon-heavy Windows fleets produce far more events than servers shipping only authentication logs. The figures below are starting points; measure after two weeks and adjust.
| Fleet | Events per second | Storage for 90 days | Host |
|---|---|---|---|
| About 50 endpoints | ≈ 0.5k | 40 to 80 GB | 4 vCPU, 16 GB RAM |
| Up to about 200 endpoints | ≈ 2k | 150 to 300 GB | 4 to 8 vCPU, 16 to 32 GB RAM |
| About 500 endpoints | ≈ 5k | 0.4 to 0.8 TB | 8 to 16 vCPU, 32 to 64 GB RAM, NVMe |
For larger fleets, support sizes the deployment with you. See Scaling.
Network
Inbound to the deployment, from your network:
| Purpose | Who connects |
|---|---|
| Console and portal over HTTPS | Analysts' browsers, customers' browsers |
| Agent connections over HTTPS | Endpoint agents |
| Log ingest over TLS | Endpoint agents and your own Beats shippers |
| Syslog over TLS, and plain UDP or TCP on trusted segments | Firewalls, appliances, Linux hosts |
| HTTP JSON and Splunk HEC | Scripts and HEC-compatible products |
Port numbers are set in the deployment's environment file. Keep plain syslog on trusted segments.
Outbound from the deployment: certificate issuance, update downloads, and whatever you configure: pull connectors, a model endpoint, enrichment services, notification channels.
DNS and certificates
Create public DNS records for the console, gateway and portal hostnames, for example console.xdr.example.com, gw.xdr.example.com and portal.xdr.example.com, pointing at the host. The gateway hostname is where endpoint agents connect. XenXDR provisions TLS certificates for these names automatically, so they must resolve publicly at the first start. Log ingest over TLS uses a certificate authority generated during setup; you distribute its certificate to senders.
Browser
The console targets current versions of Chrome, Edge, Firefox and Safari. It is keyboard-first and works at 400 percent zoom; a 1440-pixel-wide window is comfortable for the Logs page.