The Carbon Black EDR Unified View server can be installed on a physical or virtualized server that meets the following requirements:

Server OS – A base install of one of the following:

  • 64-bit CentOS OS 6, 7, or 8

  • Red Hat Enterprise 6, 7, or 8

Carbon Black EDR Unified View 7.x has the same server OS requirements as Carbon Black EDR Server 7.x. See the VMware Carbon Black EDR Operating Environment Requirements (OER) Guide.

Memory and CPU – Depends on the size of your Carbon Black EDR deployment:

  • For ten or fewer Carbon Black EDR servers and up to 100 concurrent end users:

    • 8 GB of RAM

    • 4 CPU cores

  • For more than ten Carbon Black EDR servers:

    • Minimum 16 GB of RAM

    • Minimum 8 CPU cores.

Storage – Because the Carbon Black EDR Unified View server does not store search data and does not have substantial disk I/O requirements, a typical enterprise-level hard drive or equivalent is sufficient.

Note:

Carbon Black recommends configuring at least 40 GB of log space in /var/log/cb.

Carbon Black EDR servers – The Carbon Black EDR Unified View server aggregates search results from at least one Carbon Black EDR server (the minimum for a cluster). Carbon Black EDR servers that provide results to this release of Carbon Black EDR Unified View must meet the following requirements:

  • Carbon Black EDR server version 7.0 or newer.

  • HTTPS query access to each underlying Carbon Black EDR server.

    Note:

    The Carbon Black EDR Unified View server does not support HTTP proxies and must have direct HTTPS access to the servers.

  • The ability to make HTTPS API queries to the RESTful API using the configured Carbon Black EDR port, usually 443.