Skip to content

Appliance requirements

The following requirements apply to all virtual machines (VMs) or hardware that use an integration appliance. Refer to individual product integration guides for other requirements specific to the product. See Sophos NDR.

Minimum system requirements

All platforms must have, at a minimum:

  • 4 CPUs
  • 16 GB RAM
  • 160 GB storage

CPU requirements

For Sophos NDR, ensure the following CPU flags are set:

  • pdpe1gb: The packet capture technology needs this.
  • avx2: The Sophos machine learning features need this.

Both flags are available in the Intel and AMD CPUs, as shown in the table below.

NDR can also run on VMs with more current CPUs, such as Intel Core i5, as long as they have the CPU flags set. Any CPU launched since Q1'15 should work.

The system running the VM must use one of the CPU microarchitectures shown below.

Intel CPUs

Name Generation Codename Date
Skylake 6 Skylake Q3 2015
Skylake 7 Kaby Lake Q3 2016
Skylake 8 Coffee Lake Q3 2017
Skylake 9 Coffee Lake Refresh Q4 2018
Skylake 9 Cascade Lake Q2 2019
Skylake 10 Comet Lake Q3 2019
Palm Cove 10 Cannon Lake Q2 2018
Sunny Cove 10 Ice Lake Q3 2019
Cypress Cove 11 Rocket Lake Q1 2021
Golden Cove 12 Alder Lake Q4 2021
Raptor Cove 13 Raptor Lake Q4 2022

To help you identify CPUs, Intel's CPU naming conventions are shown below.

Intel CPU naming.

AMD CPUs

Name Generation Codename Date
Zen 1 Naples Q2 2017
Zen 1 Great Horned Owl Q1 2018
Zen 2 2 Rome Q3 2019
Zen 3 3 Milan Q2 2021
Zen 4 4 Genoa Q4 2022

To help you identify CPUs, AMD's CPU naming conventions are shown below.

AMD CPU naming.

Port and domain exclusions

Make sure the ports and domains below are allowed on your firewall. This lets the Sophos virtual appliance boot and download updates.

The domains you need to allow depend on whether your firewall supports wildcards.

Click the appropriate tab for details.

Domain Ports Protocols
*.sophos.com TCP/443, TCP/22 HTTPS, SSH
*.amazonaws.com TCP/443 HTTPS
*.ubuntu.com TCP/80, TCP/443, UDP/123 HTTP, HTTPS, NTP
api.snapcraft.io TCP/443 HTTPS
auth.docker.io TCP/443 HTTPS
get.k3s.io TCP/443 HTTPS
github.com TCP/443 HTTPS
objects.githubusercontent.com TCP/443 HTTPS
packages.buildkite.com TCP/443 HTTPS
production.cloudflare.docker.com TCP/443 HTTPS
raw.githubusercontent.com TCP/443 HTTPS
registry-1.docker.io TCP/443 HTTPS
sophossecops.jfrog.io TCP/443 HTTPS
Domain Port Protocol
api.snapcraft.io TCP/443 HTTPS
archive.ubuntu.com TCP/80 HTTP
auth.docker.io TCP/443 HTTPS
central.sophos.com TCP/443 HTTPS
changelogs.ubuntu.com TCP/443 HTTPS
entropy.ubuntu.com TCP/443 HTTPS
get.k3s.io TCP/443 HTTPS
github.com TCP/443 HTTPS
jfrog-prod-use1-shared-virginia-main.s3.amazonaws.com TCP/443 HTTPS
ndr.apu.sophos.com TCP/22 SSH
nta-proxy.cloudstation.eu-central-1.prod.hydra.sophos.com TCP/443 HTTPS
nta-proxy.cloudstation.eu-west-1.prod.hydra.sophos.com TCP/443 HTTPS
nta-proxy.cloudstation.us-east-2.prod.hydra.sophos.com TCP/443 HTTPS
nta-proxy.cloudstation.us-west-2.prod.hydra.sophos.com TCP/443 HTTPS
nta-proxy.cloudstation.ca-central-1.prod.hydra.sophos.com TCP/443 HTTPS
nta-proxy.cloudstation.ap-northeast-1.prod.hydra.sophos.com TCP/443 HTTPS
nta-proxy.cloudstation.ap-southeast-2.prod.hydra.sophos.com TCP/443 HTTPS
nta-proxy.cloudstation.ap-south-1.prod.hydra.sophos.com TCP/443 HTTPS
nta-proxy.cloudstation.sa-east-1.prod.hydra.sophos.com TCP/443 HTTPS
nta-push-ws.cloudstation.eu-central-1.prod.hydra.sophos.com TCP/443 HTTPS
nta-push-ws.cloudstation.eu-west-1.prod.hydra.sophos.com TCP/443 HTTPS
nta-push-ws.cloudstation.us-east-2.prod.hydra.sophos.com TCP/443 HTTPS
nta-push-ws.cloudstation.us-west-2.prod.hydra.sophos.com TCP/443 HTTPS
nta-push-ws.cloudstation.ca-central-1.prod.hydra.sophos.com TCP/443 HTTPS
nta-push-ws.cloudstation.ap-northeast-1.prod.hydra.sophos.com TCP/443 HTTPS
nta-push-ws.cloudstation.ap-southeast-2.prod.hydra.sophos.com TCP/443 HTTPS
nta-push-ws.cloudstation.ap-south-1.prod.hydra.sophos.com TCP/443 HTTPS
nta-push-ws.cloudstation.sa-east-1.prod.hydra.sophos.com TCP/443 HTTPS
ntp.ubuntu.com UDP/123 NTP
objects.githubusercontent.com TCP/443 HTTPS
packages.buildkite.com TCP/443 HTTPS
production.cloudflare.docker.com TCP/443 HTTPS
raw.githubusercontent.com TCP/443 HTTPS
registry-1.docker.io TCP/443 HTTPS
s3-r-w.eu-west-1.amazonaws.com TCP/443 HTTPS
s3-r-w.eu-central-1.amazonaws.com TCP/443 HTTPS
s3-r-w.us-east-2.amazonaws.com TCP/443 HTTPS
s3-r-w.us-west-2.amazonaws.com TCP/443 HTTPS
s3-r-w.ca-central-1.amazonaws.com TCP/443 HTTPS
s3-r-w.ap-southeast-2.amazonaws.com TCP/443 HTTPS
s3-r-w.ap-northeast-1.amazonaws.com TCP/443 HTTPS
s3-r-w.ap-south-1.amazonaws.com TCP/443 HTTPS
s3-r-w.sa-east-1.amazonaws.com TCP/443 HTTPS
sdu-feedback.sophos.com TCP/443 HTTPS
security.ubuntu.com TCP/80 HTTP
sophossecops.jfrog.io TCP/443 HTTPS
tf-nta-sva-images-cloudstation-eu-west-1-prod-bucket.s3.eu-west-1.amazonaws.com TCP/443 HTTPS
tf-nta-sva-images-cloudstation-eu-central-1-prod-bucket.s3.eu-central-1.amazonaws.com TCP/443 HTTPS
tf-nta-sva-images-cloudstation-us-east-2-prod-bucket.s3.us-east-2.amazonaws.com TCP/443 HTTPS
tf-nta-sva-images-cloudstation-us-west-2-prod-bucket.s3.us-west-2.amazonaws.com TCP/443 HTTPS
tf-nta-sva-images-cloudstation-ca-central-1-prod-bucket.s3.ca-central-1.amazonaws.com TCP/443 HTTPS
tf-nta-sva-images-cloudstation-ap-southeast-2-prod-bucket.s3.ap-southeast-2.amazonaws.com TCP/443 HTTPS
tf-nta-sva-images-cloudstation-ap-northeast-1-prod-bucket.s3.ap-northeast-1.amazonaws.com TCP/443 HTTPS
tf-nta-sva-images-cloudstation-ap-south-1-prod-bucket.s3.ap-south-1.amazonaws.com TCP/443 HTTPS
tf-nta-sva-images-cloudstation-sa-east-1-prod-bucket.s3.sa-east-1.amazonaws.com TCP/443 HTTPS
tf-presigned-url-eu-west-1-prod-ndr-bucket.s3.eu-west-1.amazonaws.com TCP/443 HTTPS
tf-presigned-url-eu-central-1-prod-ndr-bucket.s3.eu-central-1.amazonaws.com TCP/443 HTTPS
tf-presigned-url-us-east-2-prod-ndr-bucket.s3.us-east-2.amazonaws.com TCP/443 HTTPS
tf-presigned-url-us-west-2-prod-ndr-bucket.s3.us-west-2.amazonaws.com TCP/443 HTTPS
tf-presigned-url-ca-central-1-prod-ndr-bucket.s3.ca-central-1.amazonaws.com TCP/443 HTTPS
tf-presigned-url-ap-southeast-2-prod-ndr-bucket.s3.ap-southeast-2.amazonaws.com TCP/443 HTTPS
tf-presigned-url-ap-northeast-1-prod-ndr-bucket.s3.ap-northeast-1.amazonaws.com TCP/443 HTTPS
tf-presigned-url-ap-south-1-prod-ndr-bucket.s3.ap-south-1.amazonaws.com TCP/443 HTTPS
tf-presigned-url-sa-east-1-prod-ndr-bucket.s3.sa-east-1.amazonaws.com TCP/443 HTTPS