Sizing calculator

After you have selected the deployment scenario that is most appropriate for your IT infrastructure, you must calculate the hardware requirements for servers used for installing application components.

Calculations for the Sensor component

These calculations also apply when the application is deployed on a virtual platform.

When calculating the hardware requirements for the Sensor component, consider that the maximum traffic volume that can be processed is 10 Gbps. This maximum traffic volume can be processed on one Sensor installed on a standalone server or on multiple Sensors installed on standalone servers which are connected to one Central Node. The total traffic volume from all Sensors connected to one Central Node may not exceed 10 Gbps.

If the network includes more than one 10 Gbps segment and you need to process traffic in these segments, you must use the distributed solution mode.

You can use a server hosting the Sensor as a proxy server during data exchange between workstations with Endpoint Agent and the Central Node to simplify configuration of network rules. For example, if workstations with Endpoint Agent are in a separate segment of the network, it is sufficient to configure a connection between Central Node and Sensor servers.

When using the Sensor as a proxy server for communication between Endpoint Agent components and the Central Node component, consider the following limitations:

• A maximum of 15,000 workstations with the Endpoint Agent component can connect to a single Central Node component.
• The maximum allowed packet loss between Sensor servers and the Central Node is 10% with a packet delay of up to 100 ms.

The required bandwidth of the link between Central Node and Sensor servers depends on the traffic volume that must be processed and is calculated as follows:

10% SPAN port traffic at typical load or 20% of the SPAN port traffic at peak load + email traffic + ICAP traffic + requirement for the link between the Central Node and the Endpoint Agent

Hardware requirements for the Sensor server

The Sensor component can be integrated with the IT infrastructure of an organization as follows:

• Receive mirrored traffic from network devices from SPAN ports.
• Connect to a mail server over the POP3 protocol.
• Connect to a mail server over the SMTP protocol.
• Receive traffic from a proxy server over the ICAP protocol.

The hardware requirements for the Sensor server are listed in the table below. The calculations are provided for a case in which the Sensor processes email messages and mirrored traffic from SPAN ports. If the Sensor is used as a proxy server for communication between Endpoint Agent workstations and the Central Node, you must also take into account the link requirements.

Hardware requirements for the Sensor server depending on the volume of processed traffic from SPAN ports

The CPU must support the BMI2, AVX, and AVX2 instruction sets.

If you want to process only email messages, but not mirrored traffic from SPAN ports, we recommend using a Sensor installed on the same server as the Central Node. For more details about the hardware requirements, see the Calculations for the Central Node component section → Hardware requirements for the Central Node and Sensor server.

If one Sensor server processes traffic via multiple protocols, to calculate the server hardware, you must consider that mail server or mail sensor integration requires disabling SMTP traffic processing.

Disk space requirements on a Sensor server

It is recommended to use a RAID 1 disk array. The total disk space must be at least 500 GB.

Hardware requirements of the Sensor when saving raw network traffic

If you are saving raw network traffic, the hardware requirements of the Sensor server are higher:

• 0.5 CPU for each 1 Gbps of network traffic.
• 6 GB of RAM for under 2 Gbps of network traffic, or 12 GB of RAM for over 2 Gbps of network traffic.
• Install separate disk storage in the form of a RAID array or DAS pool with the maximum bandwidth calculated using the following formula:

  <disk storage bandwidth> = 3 * <maximum throughput of recorded traffic>

• The capacity of disk storage is determined by the expected storage duration and the maximum throughput of traffic being saved, with filters taken into account. According to approximate calculations, to store recorded traffic with a maximum throughput of 10 Gbps for 7 days, you need 750 TiB of disk storage.

Calculations for the Central Node component

Deploying the application on a virtual platform requires 10 percent more CPU resources than deploying the application on a physical server. In virtual disk settings, a Thick Provision disk type must be selected.

To avoid possible performance degradation when deploying the application on a virtual platform, we recommend to:

• Set Latency Sensitivity to High.
• Reserve all memory.
• Reserve all CPU.

Hardware requirements for a server with the Central Node and Sensor components

The hardware requirements for a server on which the Central Node and Sensor components are installed depend on the following conditions:

• Volume of processed traffic

  To determine the volume of processed decrypted traffic for calculating the load on the server, use the following formula:

  <volume of decrypted traffic transmitted by ArtX TLSProxy 1.9.1> = 5 * <volume of unencrypted traffic>

  To determine the volume of traffic processed on the ICAP server for calculating the load on the server, use the following formula:

  <volume of traffic processed on the ICAP server> = 5 * <volume of traffic that is not processed on the ICAP server>

• Number of email messages processed per second
• Number of Endpoint Agent hosts

  The Endpoint Agent component can be installed on a workstation, terminal server, file server, or network attached storage (NAS).

  Information about the compatibility of versions of applications that represent the Endpoint Agent component with versions of Kaspersky Anti Targeted Attack Platform is provided in the following Help sections: Kaspersky Endpoint Agent for Windows, Kaspersky Endpoint Security for Windows, Kaspersky Endpoint Security for Linux, Kaspersky Endpoint Security for Mac.

  Kaspersky Endpoint Agent for Windows can also be installed on a SCADA server.

  To determine the effective number of hosts with the Endpoint Agent component for calculating the server load, you can use the following formula:

  K = A+3*B+20*C

  where

  • 'K' is the maximum number of hosts with the Endpoint Agent component.
  • 'A' is the number of workstations and users of terminal servers running a Windows operating system with the Endpoint Agent component installed.
  • 'B' is the number of workstations and users of terminal servers running a Linux or macOS operating system with the Endpoint Agent component installed.
  • "C" is the number of servers.

If the volume of processed traffic is greater than 1 Gbps, you must install Central Node and Sensor components on standalone servers.

The hardware requirements for the server with the Central Node component depending on the utilized functionality are presented in the table below.

To run Kaspersky Anti Targeted Attack Platform on Astra Linux, you must configure the application.

Hardware requirements for the server with the Central Node component when using KEDR functionality

Hardware requirements for the server with the Central Node component when using KATA and KEDR functionality

Hardware requirements for the server with the Central Node component when using КАТА functionality

Kaspersky Anti Targeted Attack Platform does not support operation with software RAID array.

The CPU must support the BMI2 instruction set.

Disk space requirements on the Central Node server

The server with the Central Node component must have at least 2000 GB of free space on the first disk subsystem and at least 2400 GB on the second disk subsystem. The amount of space required on the second disk subsystem depends on the preferred storage policy and can be calculated using the following formula:

150 GB + <number of Kaspersky Endpoint Agent or Kaspersky Endpoint Security for Windows hosts>/15,000 * (400 GB + 240 GB * <number of days to store data>)/0.65, but no more than 12 TB.

This formula can be used to roughly estimate the required disk space. The actual amount of stored data depends on the traffic profile of the organization and may differ from the calculated result.

If you did not install the Central Node and Sensor component as a high availability cluster, you must calculate the disk space for the Events database, GB and Storage, GB settings using the following formula:

A = F - R, GB.

where

• 'A' is the space used by the events database and the Storage.
• 'F' is the size of the hard drive on which the Central Node component is installed.
• 'R' is the reserved amount of free space (GB) corresponding to the number of connected hosts with the Endpoint Agent component; this parameter is taken from the table below.

If the number of hosts connected to the Central Node component is in between the listed values, use the larger number in your calculations.

Reserved amount of free space depending on the number of Endpoint Agent hosts

If you have configured integration for scanning external system objects using the REST API, the hardware requirements of the Central Node server must be increased. Additional hardware requirements are presented in the table below.

Hardware requirements for the server with the Central Node component with integrated external systems

If you configured integration to send events to an external system using the REST API, you must increase the hardware requirements of the Central Node server by 1 logical core and 6 GB of RAM.

If you are saving network traffic, the hardware requirements of the Central Node server must be increased. For more details on hardware requirements, see Calculations for the Sensor component → Hardware requirements of the Sensor when saving raw network traffic.

Requirements for the PCN server in distributed solution mode

If you are using distributed solution mode, to calculate the hardware requirements, you must take into account that the hardware requirements of the PCN server are 10% higher in terms of RAM and the number of logical cores than the hardware requirements of the server with the Central Node component. The hardware requirements of the server with the Central Node component are listed in the following tables: Hardware requirements for the server with the Central Node component when using KEDR functionality; Hardware requirements for the server with the Central Node component when using KATA+KEDR functionality; Hardware requirements for the server with the Central Node component when using КАТА functionality (see above).

You can connect up to 30 SCN servers to one PCN server.

Communication channel requirements

You must make sure that sufficient communication channel bandwidth is available between the server with the Central Node component and each network segment, depending on the number of hosts with the Endpoint Agent component in the segment. The bandwidth requirements depending on the number of hosts with the Endpoint Agent component is listed in the table below.

Communication channel bandwidth depending on the number of Endpoint Agent hosts

Minimum requirements for the communication channel between the PCN and SCN servers in distributed solution mode are listed in the table below.

Minimum requirements for the communication channel between the PCN and SCN servers

Hardware requirements for Central Node cluster servers

A cluster must include at least 4 servers: 2 storage servers and 2 processing servers. If you have up to 15,000 connected hosts with the Kaspersky Endpoint Agent component, you need at least 2 storage servers and 2 processing servers. If you have from 15,000 to 30,000 connected hosts with the Kaspersky Endpoint Agent component, you need at least 2 storage servers and 3 processing servers.

Each cluster server must have two network adapters to configure cluster and external subnet. The cluster subnet must be capable of up to 10 Gbps.

The cluster subnet must also meet the following requirements:

• A cluster subnet must include only the cluster servers and network switches.
• The cluster subnet must be isolated.
• The cluster servers must all be in the same L1 or L2 segment. To do this, you can connect all the servers in the cluster to a single network switch or use software tunneling. For example, L2TPv3 or Overlay Transport Virtualization (OTV).
• The "network latency" value must meet the "single digit latency" requirement, that is, the value must be less than 10 milliseconds.

The hardware requirements for cluster servers when using KEDR functionality are listed in the table below.

Hardware requirements for processing servers when using KEDR functionality

Hardware requirements for storage servers when using KEDR functionality

We recommend using disks of the same size for the two disk subsystems. For the second disk subsystem, you must use disks that are not combined into a RAID array.

The performance requirements for disk subsystems are equivalent to those specified in the table Hardware requirements for a server with the Central Node component when using KEDR functionality (see above).

Calculations for the Sandbox component

The hardware requirements for a server with the Sandbox component depend on the type and volume of processed traffic and on the permissible object scan time.

By default, the permissible object scan time is 1 hour. To reduce this time, you need a more powerful server or more servers with the Sandbox component.

It is recommended to calculate the configuration of the Sandbox component as follows:

1. Install the Central Node and Sensor components on one server and the Sandbox component on a different server for pilot operation of the application.

   To receive sufficient statistical data, the application must process traffic of the organization for a week.

2. Run the data recording script by executing the following commands:

   sudo kata-run.sh kata-collect --output-dir path-to-folder

   --output-dir <path to directory>

   When the script finishes running, the collect.tar.gz archive will be moved to the specified directory.

3. Forward this archive to Kaspersky Lab staff for analysis.

   If multiple virtual machines are started simultaneously, the speed of processing objects from the queue is increased.

The Sandbox component is not supported on AMD processors.

Hardware requirements for the server hosting the Sandbox component

The calculation of the number of servers with the Sandbox component when using preset images of operating systems is shown in the table below.

Hardware requirements for the Sandbox component when using preset images of operating systems

If you want to install the Sandbox component on a virtual server, you need 3 to 4 times more virtual servers to get the same performance you would get from a physical server.

Additional capacity may be required when using custom images for servers with the Sandbox component. To calculate the number of physical Sandbox servers required when using custom operating system images, you can use the following formula:

<number of files that need to be processed per hour in accordance with to user-defined Sandbox rules> * <number of custom operating system images> / 1000

To calculate the number of virtual Sandbox servers required when using custom operating system images, you can use the following formula:

<number of files that need to be processed per hour in accordance with to user-defined Sandbox rules> * <number of custom operating system images> / 280

The estimation of the number of Sandbox servers is listed for servers with the following configuration:

• When installing the Sandbox component on a physical server:
  • 2 CPUs: Intel Xeon 8 Core (HT) at 2.6 GHz or higher.
  • 80 GB of RAM
  • 2 HDDs, 300 GB each, combined into a RAID 1 array.
• When installing the Sandbox component on a VMware ESXi virtual machine:
  • Intel Xeon 15 Core (HT) CPU at 2.1 GHz or higher.
  • 32 GB of RAM
  • 300 GB HDD

    On the virtual machine:

    1. Nested virtualization enabled.
    2. Latency Sensitivity option set to High.
    3. Entire RAM is reserved.
    4. Entire CPU frequency is reserved.

  When installing the Sandbox component on a VMware ESXi virtual machine, you must set the limit for simultaneously running virtual machines to 12.

  If you plan to use custom operating system images, we recommend increasing the disk space to 600 GB or more.

Calculations for the Central Node component deployed on the KVM virtualization platform

To deploy the Central Node component in a virtual infrastructure, you must install the KVM hypervisor based on the Debian GNU/Linux 12 operating system using the QEMU 8.0.2 emulator.

When deploying the Central Node component in a virtual infrastructure, you must keep in mind the following limitations:

• It is possible to install the application with the installation files of the Ubuntu operating system only.
• Only the non-high-availability version of the application can be installed.
• You can only use the Sensor component deployed on the same server as the Central Node component.
• You can only connect a Sandbox component deployed outside the KVM virtualization platform on a physical server or on another supported virtualization platform.
• For each Central Node server deployed in a virtual infrastructure, a separate network interface must be used for receiving mirrored SPAN traffic.
• You cannot use the API to inform external systems about alerts generated by the application or the API for informing external systems about application events.
• Support for KVM virtualizations used in cloud solutions is not guaranteed.
• In the virtual machine settings, the host value must be set for the type parameter in the CPU settings and the VMware vmxnet3 value for the model parameter in the network adapter settings.

The hardware requirements for the Central Node server depending on the functionality being used are listed in the table below.

Hardware requirements of the Central Node server when using KEDR functionality

Hardware requirements of the Central Node server when using KATA and KEDR functionality

Page top