The Carbon Black EDR Unified View server can be installed on a physical or virtualized server that meets the following requirements:
Server OS – A base install of one of the following:
-
64-bit CentOS OS 6, 7, or 8
-
Red Hat Enterprise 6, 7, or 8
Carbon Black EDR Unified View 7.x has the same server OS requirements as Carbon Black EDR 7.x. See the Carbon Black EDR Server Operating Environment Requirements Guide.
Memory and CPU – Depends on the size of your Carbon Black EDR deployment:
-
For ten or fewer Carbon Black EDR servers and up to 100 concurrent end users:
-
8 GB of RAM
-
4 CPU cores
-
-
For more than ten Carbon Black EDR servers:
-
Minimum 16 GB of RAM
-
Minimum 8 CPU cores.
-
Storage – Because the Carbon Black EDR Unified View server does not store search data and does not have substantial disk I/O requirements, a typical enterprise-level hard drive or equivalent is sufficient.
Carbon Black recommends configuring at least 40 GB of log space in /var/log/cb.
Carbon Black EDR servers – The Carbon Black EDR Unified View server aggregates search results from at least one Carbon Black EDR server (the minimum for a cluster). Carbon Black EDR servers that provide results to this release of Carbon Black EDR Unified View must meet the following requirements:
-
Carbon Black EDR server version 7.0 or above.
-
HTTPS query access to each underlying Carbon Black EDR server.
Note:The Carbon Black EDR Unified View server does not support HTTP proxies and must have direct HTTPS access to the servers.
-
The ability to make HTTPS API queries to the RESTful API using the configured Carbon Black EDR port: usually 443.