Sophos NDR VM size guide
The Sophos NDR virtual appliance is a traffic analyzer that runs on a VM on an ESXI server.
You might need to configure the VM to ensure that the NDR virtual appliance gives the best performance and least impact on the network.
Here are our recommendations, based on your network traffic.
- up to 500Mbps
- up to 70,000 packets per second
- up to 1200 flows per second
You can install the virtual machine using the defaults. No changes to VM settings are required.
- up to 1Gbps
- up to 300,000 packets per second
- up to 4500 flows per second
You should resize your VM to 8 vCPUs.
VM running multiple integrations
The recommendations above are for a VM running Sophos NDR only. If it's also running one or more log collector integrations under heavy load, you might need to add more virtual CPUs.
Each log collector integration uses approximately 400MB RAM under heavy load. So you might need to add more RAM to the VM.
VM in a larger network
If your network statistics are higher than those in the Large traffic configuration, deploy multiple virtual appliances throughout your network.