System Requirements

You can run the NetWitness® UEBA standalone installation as follows:

  • NetWitness Physical Hosts (software running on hardware supplied by NetWitness)

    • Install physical hosts and connect to the network as described in the NetWitness® Platform Hardware Setup Guides and the NetWitness® Platform Physical Host Installation Guide.

    • Set up licensing for NetWitness Platform as described in the NetWitness® Platform Licensing Guide.

  • On-Premises (On-Prem) Virtual Hosts (Software Only provided by NetWitness)

Physical Host Hardware Specifications

You must install the NetWitness UEBA host on the S5 (RSA R630 appliance) hardware.

SERIES 5 (RSA R630) SPECIFICATIONS

Specification Capacity
Model RSA PowerEdge R630xl
Processor Type Intel Xeon E5 -2680v3

Processor Speed

Cache

Number of Cores

Number of Processors

Number of Threads

2.5 GHz

30MB

12

2

24

Total Memory 256GB

Internal Disk Controller

RSA PERC H730

External Disk Controller RSA PERC H830

SAN Connectivity (HBA) - Optional

N/A

Remote Management Card iDRAC8 Enterprise

Drives

Total - 6 Drives

2 x 1TB, 2.5" HDD

4 x 2TB, 2.5" HDD

Chassis 1U

Weight

18.4 kg (40.5 lbs)

NIC Card*

On Board

2 x 10 Gb Copper

2 x 10 Gb & 2 x 1Gb Copper

(Other options are available)

Dimensions

H: 4.28 cm (1.68 in.) x

W: 48.23 cm (18.98 in.)

x: 75.51 cm (29.72 in.)

Power 1100W Redundant

BTU/hr

4100 BTU/hr (max)

Amps (Spec) 1100W / 220VAC = 5A

Actual Amp Draw (Post Startup)

2.1 Amps

Events Per Second (EPS) 100K EPS

Throughput

N/A

* NIC Card options are available for swap with on-board daughter card or add on.

Virtual Host Specifications

Following is the recommended system requirements for a UEBA virtual host.

The recommended vCPU specification for UEBA is Intel Xeon CPU @2.59 Ghz.

CPU Memory Reserved Memory Allocation Disk Requirements for /var/netwitness Partition Read IOPS Write IOPS
32 cores 192GB

64GB

  • Storage: 1.5 TB

  • Provisioning: Thick

500

500

IMPORTANT: The /var/netwitness partition must be mounted on a 1.5 TB Thick-provisioned disk for storage usage.

Note: NetWitness recommends that you only deploy UEBA on a virtual host if your log collection volume is low. If you have a moderate to high log collection volume, NetWitness recommends that you deploy UEBA on the physical host.

Installation Media

Installation media are in the form of OVA packages, which are available for download and installation from Download Central. As part of your order fulfillment, NetWitness gives you access to the OVA.