[{"data":1,"prerenderedAt":681},["ShallowReactive",2],{"docs-nav-docs_en":3,"i-lucide:menu":451,"i-lucide:search":455,"i-lucide:chevron-down":457,"docs-\u002Fdocs\u002Fgetting-started\u002Frequirements":459,"docs-surround-\u002Fdocs\u002Fgetting-started\u002Frequirements":671,"docs-section-\u002Fdocs\u002Fgetting-started":674,"i-lucide:chevron-right":675,"i-lucide:arrow-right":677,"i-lucide:arrow-left":679},[4],{"title":5,"path":6,"stem":7,"children":8},"Docs","\u002Fdocs","docs",[9,15,51,111,168,199,233,275,305,339,357,399,421],{"title":10,"path":6,"stem":11,"order":12,"badge":13,"navTitle":14},"XenXDR documentation","docs\u002Findex",0,null,"Overview",{"title":16,"path":17,"stem":18,"children":19,"order":12,"badge":13,"navTitle":16},"Getting started","\u002Fdocs\u002Fgetting-started","docs\u002F01.getting-started\u002Findex",[20,21,26,31,36,41,46],{"title":16,"path":17,"stem":18,"order":12,"badge":13,"navTitle":16},{"title":22,"path":23,"stem":24,"order":25,"badge":13,"navTitle":14},"Platform overview","\u002Fdocs\u002Fgetting-started\u002Foverview","docs\u002F01.getting-started\u002F01.overview",1,{"title":27,"path":28,"stem":29,"order":30,"badge":13,"navTitle":13},"Requirements and sizing","\u002Fdocs\u002Fgetting-started\u002Frequirements","docs\u002F01.getting-started\u002F02.requirements",2,{"title":32,"path":33,"stem":34,"order":35,"badge":13,"navTitle":13},"Install with Docker Compose","\u002Fdocs\u002Fgetting-started\u002Finstall","docs\u002F01.getting-started\u002F03.install",3,{"title":37,"path":38,"stem":39,"order":40,"badge":13,"navTitle":13},"Single sign-on","\u002Fdocs\u002Fgetting-started\u002Fsingle-sign-on","docs\u002F01.getting-started\u002F04.single-sign-on",4,{"title":42,"path":43,"stem":44,"order":45,"badge":13,"navTitle":13},"First hour checklist","\u002Fdocs\u002Fgetting-started\u002Ffirst-hour","docs\u002F01.getting-started\u002F05.first-hour",5,{"title":47,"path":48,"stem":49,"order":50,"badge":13,"navTitle":13},"Production hardening checklist","\u002Fdocs\u002Fgetting-started\u002Fhardening","docs\u002F01.getting-started\u002F06.hardening",6,{"title":52,"path":53,"stem":54,"children":55,"order":12,"badge":13,"navTitle":52},"Endpoint agent","\u002Fdocs\u002Fagent","docs\u002F02.agent\u002Findex",[56,57,61,65,69,73,77,81,86,91,96,101,106],{"title":52,"path":53,"stem":54,"order":12,"badge":13,"navTitle":52},{"title":58,"path":59,"stem":60,"order":25,"badge":13,"navTitle":14},"Agent overview","\u002Fdocs\u002Fagent\u002Foverview","docs\u002F02.agent\u002F01.overview",{"title":62,"path":63,"stem":64,"order":30,"badge":13,"navTitle":13},"Supported platforms","\u002Fdocs\u002Fagent\u002Fsupported-platforms","docs\u002F02.agent\u002F02.supported-platforms",{"title":66,"path":67,"stem":68,"order":35,"badge":13,"navTitle":13},"Install on Windows","\u002Fdocs\u002Fagent\u002Finstall-windows","docs\u002F02.agent\u002F03.install-windows",{"title":70,"path":71,"stem":72,"order":40,"badge":13,"navTitle":13},"Install on Linux","\u002Fdocs\u002Fagent\u002Finstall-linux","docs\u002F02.agent\u002F04.install-linux",{"title":74,"path":75,"stem":76,"order":45,"badge":13,"navTitle":13},"Installer bundles and enrolment","\u002Fdocs\u002Fagent\u002Finstaller-bundles","docs\u002F02.agent\u002F05.installer-bundles",{"title":78,"path":79,"stem":80,"order":50,"badge":13,"navTitle":13},"Telemetry","\u002Fdocs\u002Fagent\u002Ftelemetry","docs\u002F02.agent\u002F06.telemetry",{"title":82,"path":83,"stem":84,"order":85,"badge":13,"navTitle":13},"Live response","\u002Fdocs\u002Fagent\u002Flive-response","docs\u002F02.agent\u002F07.live-response",7,{"title":87,"path":88,"stem":89,"order":90,"badge":13,"navTitle":13},"Network isolation","\u002Fdocs\u002Fagent\u002Fnetwork-isolation","docs\u002F02.agent\u002F08.network-isolation",8,{"title":92,"path":93,"stem":94,"order":95,"badge":13,"navTitle":13},"Application control","\u002Fdocs\u002Fagent\u002Fapplication-control","docs\u002F02.agent\u002F09.application-control",9,{"title":97,"path":98,"stem":99,"order":100,"badge":13,"navTitle":13},"Quick triage","\u002Fdocs\u002Fagent\u002Fquick-triage","docs\u002F02.agent\u002F10.quick-triage",10,{"title":102,"path":103,"stem":104,"order":105,"badge":13,"navTitle":13},"Updates","\u002Fdocs\u002Fagent\u002Fupdates","docs\u002F02.agent\u002F11.updates",11,{"title":107,"path":108,"stem":109,"order":110,"badge":13,"navTitle":13},"Troubleshooting the agent","\u002Fdocs\u002Fagent\u002Ftroubleshooting","docs\u002F02.agent\u002F12.troubleshooting",12,{"title":112,"path":113,"stem":114,"children":115,"order":12,"badge":13,"navTitle":112},"Data sources","\u002Fdocs\u002Fdata-sources","docs\u002F03.data-sources\u002Findex",[116,117,121,125,129,133,137,141,145,164],{"title":112,"path":113,"stem":114,"order":12,"badge":13,"navTitle":112},{"title":118,"path":119,"stem":120,"order":25,"badge":13,"navTitle":14},"Data sources overview","\u002Fdocs\u002Fdata-sources\u002Foverview","docs\u002F03.data-sources\u002F01.overview",{"title":122,"path":123,"stem":124,"order":30,"badge":13,"navTitle":13},"Ingest keys","\u002Fdocs\u002Fdata-sources\u002Fingest-keys","docs\u002F03.data-sources\u002F02.ingest-keys",{"title":126,"path":127,"stem":128,"order":35,"badge":13,"navTitle":13},"Beats","\u002Fdocs\u002Fdata-sources\u002Fbeats","docs\u002F03.data-sources\u002F03.beats",{"title":130,"path":131,"stem":132,"order":40,"badge":13,"navTitle":13},"Syslog, CEF and LEEF","\u002Fdocs\u002Fdata-sources\u002Fsyslog","docs\u002F03.data-sources\u002F04.syslog",{"title":134,"path":135,"stem":136,"order":45,"badge":13,"navTitle":13},"HTTP JSON","\u002Fdocs\u002Fdata-sources\u002Fhttp-json","docs\u002F03.data-sources\u002F05.http-json",{"title":138,"path":139,"stem":140,"order":50,"badge":13,"navTitle":13},"Splunk HEC","\u002Fdocs\u002Fdata-sources\u002Fsplunk-hec","docs\u002F03.data-sources\u002F06.splunk-hec",{"title":142,"path":143,"stem":144,"order":85,"badge":13,"navTitle":13},"Data source catalog","\u002Fdocs\u002Fdata-sources\u002Fcatalog","docs\u002F03.data-sources\u002F07.catalog",{"title":146,"path":147,"stem":148,"children":149,"order":12,"badge":13,"navTitle":146},"Connectors","\u002Fdocs\u002Fdata-sources\u002Fconnectors","docs\u002F03.data-sources\u002F08.connectors\u002Findex",[150,151,155,159],{"title":146,"path":147,"stem":148,"order":12,"badge":13,"navTitle":146},{"title":152,"path":153,"stem":154,"order":25,"badge":13,"navTitle":13},"Okta System Log","\u002Fdocs\u002Fdata-sources\u002Fconnectors\u002Fokta","docs\u002F03.data-sources\u002F08.connectors\u002F01.okta",{"title":156,"path":157,"stem":158,"order":30,"badge":13,"navTitle":13},"Microsoft Entra ID and Microsoft 365","\u002Fdocs\u002Fdata-sources\u002Fconnectors\u002Fmicrosoft-entra","docs\u002F03.data-sources\u002F08.connectors\u002F02.microsoft-entra",{"title":160,"path":161,"stem":162,"order":35,"badge":163,"navTitle":13},"Connectors coming soon","\u002Fdocs\u002Fdata-sources\u002Fconnectors\u002Fcoming-soon","docs\u002F03.data-sources\u002F08.connectors\u002F03.coming-soon","coming-soon",{"title":165,"path":166,"stem":167,"order":95,"badge":13,"navTitle":13},"Threat intelligence","\u002Fdocs\u002Fdata-sources\u002Fthreat-intel","docs\u002F03.data-sources\u002F09.threat-intel",{"title":169,"path":170,"stem":171,"children":172,"order":12,"badge":13,"navTitle":169},"Search","\u002Fdocs\u002Fsearch","docs\u002F04.search\u002Findex",[173,174,179,183,187,191,195],{"title":169,"path":170,"stem":171,"order":12,"badge":13,"navTitle":169},{"title":175,"path":176,"stem":177,"order":25,"badge":13,"navTitle":178},"The Logs page","\u002Fdocs\u002Fsearch\u002Fdiscover","docs\u002F04.search\u002F01.discover","Logs page tour",{"title":180,"path":181,"stem":182,"order":30,"badge":13,"navTitle":13},"Query syntax","\u002Fdocs\u002Fsearch\u002Fquery-syntax","docs\u002F04.search\u002F02.query-syntax",{"title":184,"path":185,"stem":186,"order":35,"badge":13,"navTitle":13},"Keyboard shortcuts","\u002Fdocs\u002Fsearch\u002Fkeyboard","docs\u002F04.search\u002F03.keyboard",{"title":188,"path":189,"stem":190,"order":40,"badge":13,"navTitle":13},"Saved views and search tabs","\u002Fdocs\u002Fsearch\u002Fsaved-views","docs\u002F04.search\u002F04.saved-views",{"title":192,"path":193,"stem":194,"order":45,"badge":13,"navTitle":13},"AI Hunt","\u002Fdocs\u002Fsearch\u002Fai-hunt","docs\u002F04.search\u002F05.ai-hunt",{"title":196,"path":197,"stem":198,"order":50,"badge":13,"navTitle":13},"Field dictionary","\u002Fdocs\u002Fsearch\u002Ffield-dictionary","docs\u002F04.search\u002F06.field-dictionary",{"title":200,"path":201,"stem":202,"children":203,"order":12,"badge":13,"navTitle":200},"Detections","\u002Fdocs\u002Fdetections","docs\u002F05.detections\u002Findex",[204,205,209,213,217,221,225,229],{"title":200,"path":201,"stem":202,"order":12,"badge":13,"navTitle":200},{"title":206,"path":207,"stem":208,"order":25,"badge":13,"navTitle":14},"Detections overview","\u002Fdocs\u002Fdetections\u002Foverview","docs\u002F05.detections\u002F01.overview",{"title":210,"path":211,"stem":212,"order":30,"badge":13,"navTitle":13},"Writing rules","\u002Fdocs\u002Fdetections\u002Fwriting-rules","docs\u002F05.detections\u002F02.writing-rules",{"title":214,"path":215,"stem":216,"order":35,"badge":13,"navTitle":13},"Importing rules","\u002Fdocs\u002Fdetections\u002Fimporting","docs\u002F05.detections\u002F03.importing",{"title":218,"path":219,"stem":220,"order":40,"badge":13,"navTitle":13},"Content pack","\u002Fdocs\u002Fdetections\u002Fcontent-pack","docs\u002F05.detections\u002F04.content-pack",{"title":222,"path":223,"stem":224,"order":45,"badge":13,"navTitle":13},"Exceptions and suppressions","\u002Fdocs\u002Fdetections\u002Fexceptions-suppressions","docs\u002F05.detections\u002F05.exceptions-suppressions",{"title":226,"path":227,"stem":228,"order":50,"badge":13,"navTitle":13},"ATT&CK coverage","\u002Fdocs\u002Fdetections\u002Fattack-coverage","docs\u002F05.detections\u002F06.attack-coverage",{"title":230,"path":231,"stem":232,"order":85,"badge":13,"navTitle":13},"Baseline signals","\u002Fdocs\u002Fdetections\u002Fbaseline-signals","docs\u002F05.detections\u002F07.baseline-signals",{"title":234,"path":235,"stem":236,"children":237,"order":12,"badge":13,"navTitle":234},"Operations","\u002Fdocs\u002Foperations","docs\u002F06.operations\u002Findex",[238,239,243,247,251,255,259,263,267,271],{"title":234,"path":235,"stem":236,"order":12,"badge":13,"navTitle":234},{"title":240,"path":241,"stem":242,"order":25,"badge":13,"navTitle":13},"Alerts","\u002Fdocs\u002Foperations\u002Falerts","docs\u002F06.operations\u002F01.alerts",{"title":244,"path":245,"stem":246,"order":30,"badge":13,"navTitle":13},"Correlations","\u002Fdocs\u002Foperations\u002Fcorrelations","docs\u002F06.operations\u002F02.correlations",{"title":248,"path":249,"stem":250,"order":35,"badge":13,"navTitle":13},"Cases","\u002Fdocs\u002Foperations\u002Fcases","docs\u002F06.operations\u002F03.cases",{"title":252,"path":253,"stem":254,"order":40,"badge":13,"navTitle":13},"Case categories","\u002Fdocs\u002Foperations\u002Fcase-categories","docs\u002F06.operations\u002F04.case-categories",{"title":256,"path":257,"stem":258,"order":45,"badge":13,"navTitle":13},"SLA","\u002Fdocs\u002Foperations\u002Fsla","docs\u002F06.operations\u002F05.sla",{"title":260,"path":261,"stem":262,"order":50,"badge":13,"navTitle":13},"Reports","\u002Fdocs\u002Foperations\u002Freports","docs\u002F06.operations\u002F06.reports",{"title":264,"path":265,"stem":266,"order":85,"badge":13,"navTitle":13},"Tickets","\u002Fdocs\u002Foperations\u002Ftickets","docs\u002F06.operations\u002F07.tickets",{"title":268,"path":269,"stem":270,"order":90,"badge":13,"navTitle":13},"Notifications","\u002Fdocs\u002Foperations\u002Fnotifications","docs\u002F06.operations\u002F08.notifications",{"title":272,"path":273,"stem":274,"order":95,"badge":13,"navTitle":13},"Dashboards","\u002Fdocs\u002Foperations\u002Fdashboards","docs\u002F06.operations\u002F09.dashboards",{"title":276,"path":277,"stem":278,"children":279,"order":12,"badge":13,"navTitle":276},"AI","\u002Fdocs\u002Fai","docs\u002F07.ai\u002Findex",[280,281,285,289,293,297,301],{"title":276,"path":277,"stem":278,"order":12,"badge":13,"navTitle":276},{"title":282,"path":283,"stem":284,"order":25,"badge":13,"navTitle":14},"AI overview","\u002Fdocs\u002Fai\u002Foverview","docs\u002F07.ai\u002F01.overview",{"title":286,"path":287,"stem":288,"order":30,"badge":13,"navTitle":13},"Triage verdicts","\u002Fdocs\u002Fai\u002Ftriage-verdicts","docs\u002F07.ai\u002F02.triage-verdicts",{"title":290,"path":291,"stem":292,"order":35,"badge":13,"navTitle":13},"Investigation agent","\u002Fdocs\u002Fai\u002Finvestigation-agent","docs\u002F07.ai\u002F03.investigation-agent",{"title":294,"path":295,"stem":296,"order":40,"badge":13,"navTitle":13},"Notes, handovers and report drafts","\u002Fdocs\u002Fai\u002Fnotes-and-reports","docs\u002F07.ai\u002F04.notes-and-reports",{"title":298,"path":299,"stem":300,"order":45,"badge":13,"navTitle":13},"Model setup","\u002Fdocs\u002Fai\u002Fmodel-setup","docs\u002F07.ai\u002F05.model-setup",{"title":302,"path":303,"stem":304,"order":50,"badge":13,"navTitle":13},"Feedback","\u002Fdocs\u002Fai\u002Ffeedback","docs\u002F07.ai\u002F06.feedback",{"title":306,"path":307,"stem":308,"children":309,"order":12,"badge":13,"navTitle":306},"Automation","\u002Fdocs\u002Fautomation","docs\u002F08.automation\u002Findex",[310,311,315,319,323,327,331,335],{"title":306,"path":307,"stem":308,"order":12,"badge":13,"navTitle":306},{"title":312,"path":313,"stem":314,"order":25,"badge":13,"navTitle":13},"Playbooks","\u002Fdocs\u002Fautomation\u002Fplaybooks","docs\u002F08.automation\u002F01.playbooks",{"title":316,"path":317,"stem":318,"order":30,"badge":13,"navTitle":13},"The workflow builder","\u002Fdocs\u002Fautomation\u002Fbuilder","docs\u002F08.automation\u002F02.builder",{"title":320,"path":321,"stem":322,"order":35,"badge":13,"navTitle":13},"Block reference","\u002Fdocs\u002Fautomation\u002Fblocks","docs\u002F08.automation\u002F03.blocks",{"title":324,"path":325,"stem":326,"order":40,"badge":13,"navTitle":13},"Modes and ceilings","\u002Fdocs\u002Fautomation\u002Fmodes-and-ceilings","docs\u002F08.automation\u002F04.modes-and-ceilings",{"title":328,"path":329,"stem":330,"order":45,"badge":13,"navTitle":13},"Response actions","\u002Fdocs\u002Fautomation\u002Fresponse-actions","docs\u002F08.automation\u002F05.response-actions",{"title":332,"path":333,"stem":334,"order":50,"badge":13,"navTitle":13},"Egress and notifications","\u002Fdocs\u002Fautomation\u002Fegress","docs\u002F08.automation\u002F06.egress",{"title":336,"path":337,"stem":338,"order":85,"badge":13,"navTitle":13},"Playbook runs","\u002Fdocs\u002Fautomation\u002Fruns","docs\u002F08.automation\u002F07.runs",{"title":340,"path":341,"stem":342,"children":343,"order":12,"badge":13,"navTitle":340},"Fleet","\u002Fdocs\u002Ffleet","docs\u002F09.fleet\u002Findex",[344,345,349,353],{"title":340,"path":341,"stem":342,"order":12,"badge":13,"navTitle":340},{"title":346,"path":347,"stem":348,"order":25,"badge":13,"navTitle":13},"Hosts","\u002Fdocs\u002Ffleet\u002Fhosts","docs\u002F09.fleet\u002F01.hosts",{"title":350,"path":351,"stem":352,"order":30,"badge":13,"navTitle":13},"Risk score","\u002Fdocs\u002Ffleet\u002Frisk-score","docs\u002F09.fleet\u002F02.risk-score",{"title":354,"path":355,"stem":356,"order":35,"badge":13,"navTitle":13},"Response console","\u002Fdocs\u002Ffleet\u002Fresponse-console","docs\u002F09.fleet\u002F03.response-console",{"title":358,"path":359,"stem":360,"children":361,"order":12,"badge":13,"navTitle":358},"Administration","\u002Fdocs\u002Fadministration","docs\u002F10.administration\u002Findex",[362,363,367,371,375,379,383,387,391,395],{"title":358,"path":359,"stem":360,"order":12,"badge":13,"navTitle":358},{"title":364,"path":365,"stem":366,"order":25,"badge":13,"navTitle":13},"Organizations","\u002Fdocs\u002Fadministration\u002Forganizations","docs\u002F10.administration\u002F01.organizations",{"title":368,"path":369,"stem":370,"order":30,"badge":13,"navTitle":13},"Users and roles","\u002Fdocs\u002Fadministration\u002Fusers-and-roles","docs\u002F10.administration\u002F02.users-and-roles",{"title":372,"path":373,"stem":374,"order":35,"badge":13,"navTitle":13},"Audit log","\u002Fdocs\u002Fadministration\u002Faudit-log","docs\u002F10.administration\u002F03.audit-log",{"title":376,"path":377,"stem":378,"order":40,"badge":13,"navTitle":13},"Retention","\u002Fdocs\u002Fadministration\u002Fretention","docs\u002F10.administration\u002F04.retention",{"title":380,"path":381,"stem":382,"order":45,"badge":13,"navTitle":13},"Backups and restore","\u002Fdocs\u002Fadministration\u002Fbackups","docs\u002F10.administration\u002F05.backups",{"title":384,"path":385,"stem":386,"order":50,"badge":13,"navTitle":13},"Upgrades","\u002Fdocs\u002Fadministration\u002Fupgrades","docs\u002F10.administration\u002F06.upgrades",{"title":388,"path":389,"stem":390,"order":85,"badge":13,"navTitle":13},"Monitoring the deployment","\u002Fdocs\u002Fadministration\u002Fmonitoring","docs\u002F10.administration\u002F07.monitoring",{"title":392,"path":393,"stem":394,"order":90,"badge":13,"navTitle":13},"Scaling","\u002Fdocs\u002Fadministration\u002Fscaling","docs\u002F10.administration\u002F08.scaling",{"title":396,"path":397,"stem":398,"order":95,"badge":13,"navTitle":13},"Settings reference","\u002Fdocs\u002Fadministration\u002Fsettings-reference","docs\u002F10.administration\u002F09.settings-reference",{"title":400,"path":401,"stem":402,"children":403,"order":12,"badge":13,"navTitle":400},"Customer portal","\u002Fdocs\u002Fcustomer-portal","docs\u002F11.customer-portal\u002Findex",[404,405,409,413,417],{"title":400,"path":401,"stem":402,"order":12,"badge":13,"navTitle":400},{"title":406,"path":407,"stem":408,"order":25,"badge":13,"navTitle":14},"Customer portal overview","\u002Fdocs\u002Fcustomer-portal\u002Foverview","docs\u002F11.customer-portal\u002F01.overview",{"title":410,"path":411,"stem":412,"order":30,"badge":13,"navTitle":13},"Inviting customers","\u002Fdocs\u002Fcustomer-portal\u002Finviting-customers","docs\u002F11.customer-portal\u002F02.inviting-customers",{"title":414,"path":415,"stem":416,"order":35,"badge":13,"navTitle":13},"What customers see","\u002Fdocs\u002Fcustomer-portal\u002Fwhat-customers-see","docs\u002F11.customer-portal\u002F03.what-customers-see",{"title":418,"path":419,"stem":420,"order":40,"badge":13,"navTitle":13},"Portal security","\u002Fdocs\u002Fcustomer-portal\u002Fsecurity","docs\u002F11.customer-portal\u002F04.security",{"title":422,"path":423,"stem":424,"children":425,"order":12,"badge":13,"navTitle":422},"Reference","\u002Fdocs\u002Freference","docs\u002F12.reference\u002Findex",[426,427,431,435,439,443,447],{"title":422,"path":423,"stem":424,"order":12,"badge":13,"navTitle":422},{"title":428,"path":429,"stem":430,"order":25,"badge":13,"navTitle":13},"Glossary","\u002Fdocs\u002Freference\u002Fglossary","docs\u002F12.reference\u002F01.glossary",{"title":432,"path":433,"stem":434,"order":30,"badge":13,"navTitle":13},"Support tiers","\u002Fdocs\u002Freference\u002Fsupport-tiers","docs\u002F12.reference\u002F02.support-tiers",{"title":436,"path":437,"stem":438,"order":35,"badge":13,"navTitle":13},"Compatibility","\u002Fdocs\u002Freference\u002Fcompatibility","docs\u002F12.reference\u002F03.compatibility",{"title":440,"path":441,"stem":442,"order":40,"badge":13,"navTitle":13},"Notification kinds","\u002Fdocs\u002Freference\u002Fnotification-kinds","docs\u002F12.reference\u002F04.notification-kinds",{"title":444,"path":445,"stem":446,"order":45,"badge":13,"navTitle":13},"Data source catalog (reference)","\u002Fdocs\u002Freference\u002Fdata-source-catalog","docs\u002F12.reference\u002F05.data-source-catalog",{"title":448,"path":449,"stem":450,"order":50,"badge":13,"navTitle":13},"Release notes","\u002Fdocs\u002Freference\u002Frelease-notes","docs\u002F12.reference\u002F06.release-notes",{"left":12,"top":12,"width":452,"height":452,"rotate":12,"vFlip":453,"hFlip":453,"body":454},24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5h16M4 12h16M4 19h16\"\u002F>",{"left":12,"top":12,"width":452,"height":452,"rotate":12,"vFlip":453,"hFlip":453,"body":456},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m21 21l-4.34-4.34\"\u002F>\u003Ccircle cx=\"11\" cy=\"11\" r=\"8\"\u002F>\u003C\u002Fg>",{"left":12,"top":12,"width":452,"height":452,"rotate":12,"vFlip":453,"hFlip":453,"body":458},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m6 9l6 6l6-6\"\u002F>",{"id":460,"title":27,"audience":13,"badge":13,"body":461,"description":665,"extension":666,"meta":667,"navTitle":13,"navigation":668,"order":30,"path":28,"seo":669,"stem":29,"updated":13,"__hash__":670},"docs_en\u002Fdocs\u002F01.getting-started\u002F02.requirements.md",{"type":462,"value":463,"toc":657},"minimark",[464,469,482,486,490,556,563,567,570,624,627,630,634,650,654],[465,466,468],"h2",{"id":467},"host","Host",[470,471,472,476,479],"ul",{},[473,474,475],"li",{},"One Linux server (a virtual machine is fine). Ubuntu 22.04 or later and Debian 12 or later are tested; other distributions with Docker Engine work.",[473,477,478],{},"Docker Engine 24 or later with Docker Compose v2.",[473,480,481],{},"NVMe or equivalent low-latency storage for the database volume. Spinning disks make search slow.",[465,483,485],{"id":484},"sizing","Sizing",[487,488,489],"p",{},"Throughput and storage depend on your telemetry mix. Sysmon-heavy Windows fleets produce far more events than servers shipping only authentication logs. The figures below are starting points; measure after two weeks and adjust.",[491,492,493,510],"table",{},[494,495,496],"thead",{},[497,498,499,502,505,508],"tr",{},[500,501,340],"th",{},[500,503,504],{},"Events per second",[500,506,507],{},"Storage for 90 days",[500,509,468],{},[511,512,513,528,542],"tbody",{},[497,514,515,519,522,525],{},[516,517,518],"td",{},"About 50 endpoints",[516,520,521],{},"≈ 0.5k",[516,523,524],{},"40 to 80 GB",[516,526,527],{},"4 vCPU, 16 GB RAM",[497,529,530,533,536,539],{},[516,531,532],{},"Up to about 200 endpoints",[516,534,535],{},"≈ 2k",[516,537,538],{},"150 to 300 GB",[516,540,541],{},"4 to 8 vCPU, 16 to 32 GB RAM",[497,543,544,547,550,553],{},[516,545,546],{},"About 500 endpoints",[516,548,549],{},"≈ 5k",[516,551,552],{},"0.4 to 0.8 TB",[516,554,555],{},"8 to 16 vCPU, 32 to 64 GB RAM, NVMe",[487,557,558,559,562],{},"For larger fleets, support sizes the deployment with you. See ",[560,561,392],"a",{"href":393},".",[465,564,566],{"id":565},"network","Network",[487,568,569],{},"Inbound to the deployment, from your network:",[491,571,572,582],{},[494,573,574],{},[497,575,576,579],{},[500,577,578],{},"Purpose",[500,580,581],{},"Who connects",[511,583,584,592,600,608,616],{},[497,585,586,589],{},[516,587,588],{},"Console and portal over HTTPS",[516,590,591],{},"Analysts' browsers, customers' browsers",[497,593,594,597],{},[516,595,596],{},"Agent connections over HTTPS",[516,598,599],{},"Endpoint agents",[497,601,602,605],{},[516,603,604],{},"Log ingest over TLS",[516,606,607],{},"Endpoint agents and your own Beats shippers",[497,609,610,613],{},[516,611,612],{},"Syslog over TLS, and plain UDP or TCP on trusted segments",[516,614,615],{},"Firewalls, appliances, Linux hosts",[497,617,618,621],{},[516,619,620],{},"HTTP JSON and Splunk HEC",[516,622,623],{},"Scripts and HEC-compatible products",[487,625,626],{},"Port numbers are set in the deployment's environment file. Keep plain syslog on trusted segments.",[487,628,629],{},"Outbound from the deployment: certificate issuance, update downloads, and whatever you configure: pull connectors, a model endpoint, enrichment services, notification channels.",[465,631,633],{"id":632},"dns-and-certificates","DNS and certificates",[487,635,636,637,641,642,645,646,649],{},"Create public DNS records for the console, gateway and portal hostnames, for example ",[638,639,640],"code",{},"console.xdr.example.com",", ",[638,643,644],{},"gw.xdr.example.com"," and ",[638,647,648],{},"portal.xdr.example.com",", pointing at the host. The gateway hostname is where endpoint agents connect. XenXDR provisions TLS certificates for these names automatically, so they must resolve publicly at the first start. Log ingest over TLS uses a certificate authority generated during setup; you distribute its certificate to senders.",[465,651,653],{"id":652},"browser","Browser",[487,655,656],{},"The console targets current versions of Chrome, Edge, Firefox and Safari. It is keyboard-first and works at 400 percent zoom; a 1440-pixel-wide window is comfortable for the Logs page.",{"title":658,"searchDepth":35,"depth":35,"links":659},"",[660,661,662,663,664],{"id":467,"depth":30,"text":468},{"id":484,"depth":30,"text":485},{"id":565,"depth":30,"text":566},{"id":632,"depth":30,"text":633},{"id":652,"depth":30,"text":653},"Hardware, operating system, network and DNS requirements for a self-hosted deployment, with sizing guidance by fleet size.","md",{},true,{"title":27,"description":665},"s4LJQIMgbgaTFxZhTtnNKXueYmS3vooBENXwpGVZ4xY",[672,673],{"title":22,"path":23,"stem":24,"children":-1},{"title":32,"path":33,"stem":34,"children":-1},{"title":16,"navTitle":16},{"left":12,"top":12,"width":452,"height":452,"rotate":12,"vFlip":453,"hFlip":453,"body":676},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m9 18l6-6l-6-6\"\u002F>",{"left":12,"top":12,"width":452,"height":452,"rotate":12,"vFlip":453,"hFlip":453,"body":678},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14m-7-7l7 7l-7 7\"\u002F>",{"left":12,"top":12,"width":452,"height":452,"rotate":12,"vFlip":453,"hFlip":453,"body":680},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 19l-7-7l7-7m7 7H5\"\u002F>",1789936658371]