The Carbon Black EDR Unified View server can be installed on a physical or virtualized server that meets the following requirements:

Server OS – A base install of one of the following:

  • 64-bit CentOS OS 6, 7, or 8

  • Red Hat Enterprise 6, 7, or 8

Note:

Carbon Black EDR Unified View 7.x has the same server OS requirements as Carbon Black EDR 7.x. See the Carbon Black EDR Server Operating Environment Requirements Guide.

Memory and CPU – Depends on the size of your Carbon Black EDR deployment:

  • For ten or fewer Carbon Black EDR servers and up to 100 concurrent end users:

    • 8 GB of RAM

    • 4 CPU cores

  • For more than ten Carbon Black EDR servers:

    • Minimum 16 GB of RAM

    • Minimum 8 CPU cores.

Storage – Because the Carbon Black EDR Unified View server does not store search data and does not have substantial disk I/O requirements, a typical enterprise-level hard drive or equivalent is sufficient.

Note:

Carbon Black recommends configuring at least 40 GB of log space in /var/log/cb.

Carbon Black EDR servers – The Carbon Black EDR Unified View server aggregates search results from at least one Carbon Black EDR server (the minimum for a cluster). Carbon Black EDR servers that provide results to this release of Carbon Black EDR Unified View must meet the following requirements:

  • Carbon Black EDR server version 7.0 or above.

  • HTTPS query access to each underlying Carbon Black EDR server.

    Note:

    The Carbon Black EDR Unified View server does not support HTTP proxies and must have direct HTTPS access to the servers.

  • The ability to make HTTPS API queries to the RESTful API using the configured Carbon Black EDR port: usually 443.