NeQter System Specifications
Use a NeQter-supplied appliance or a virtual machine sized for the licensed storage tier. The values below are baseline deployment profiles. Contact sales@neqterlabs.com or NeQter Support before changing CPU, memory, storage, or platform layout.
Table of contents
Supported deployment profiles
| Resource | 500 GB tier | 1 TB tier | 2 TB tier | 4 TB tier | 8 TB tier |
|---|---|---|---|---|---|
| CPU | 6-8 cores | 6-8 cores | 6-8 cores | 8-12 cores | 8-12 cores |
| Memory | 32 GB | 64 GB | 64 GB | 128 GB | 128 GB |
| Storage | 500 GB SSD | 1 TB SSD | 2 TB SSD | 4 TB SSD | 8 TB SSD |
The storage tier affects indexed log capacity, archive behavior, report generation, scanner data retention, and available working room for updates. Do not treat the size as raw usable customer data. The appliance also needs operating-system, database, backup, search, and temporary working space.
Virtual machine requirements
Before deployment, verify the VM has:
- reserved or reliably available CPU and memory;
- SSD-backed storage with low latency;
- a single, stable management address unless NeQter Support has approved another layout;
- a connected network path to log sources, agents, cloud integrations, NTP, DNS, and update services;
- enough free storage for indexed data, archives, settings backups, reports, scanner feeds, and updates;
- console or hypervisor access for network, certificate, restart, or shutdown recovery.
If the appliance is undersized, services may become slow, logs may stop indexing, reports may fail, vulnerability scans may queue, or updates may not complete.
Network readiness
Confirm these items with the network or firewall administrator before using the appliance:
| Item | Why it matters |
|---|---|
| Management URL | Users need a stable browser URL for login and bookmarks. |
| DNS | The appliance must resolve internal hosts, mail servers, update services, and integration endpoints. |
| NTP | Accurate time is required for certificates, log ordering, authentication, schedules, scanner reports, and compliance evidence. |
| Syslog reachability | Network devices must be able to send logs to the NeQter input address and port. |
| Agent reachability | Agent hosts must be able to check in with the appliance. |
| Cloud API reachability | Cloud integrations such as Microsoft Office 365, Google Workspace, Cisco Meraki, and Cisco Secure Endpoint need outbound access. |
| Vulnerability feed access | The scanner must receive current vulnerability-test data before scans can be trusted. |
| Mail delivery | Alerts and scheduled reports need an approved outbound mail method. |
Backup and retention planning
Configure backups before relying on the appliance for production monitoring.
- Open Settings -> Backups.
- Confirm log-retention requirements.
- Configure archive creation and archive retention.
- Configure settings backups.
- Configure remote archive storage if required.
- Export and store the recovery key when available.
- Test restore procedures before an incident.
Do not use hypervisor snapshots as the only backup method. A snapshot taken while search and database services are active may not be application-consistent.
Deployment checklist
Before handing the appliance to users, confirm:
- the installed version is the expected NeQter release under Settings -> Updates;
- the time zone and NTP servers are correct under Settings -> Time;
- backups and retention are configured under Settings -> Backups;
- at least two authorized global administrator accounts exist;
- mail has been tested under Settings -> Mail;
- required inputs are configured under Settings -> Inputs;
- required dashboards are enabled under Settings -> Dashboards;
- scanner feeds are current before production scans;
- customer firewall rules allow only required traffic.
Maintenance considerations
Schedule updates, large vulnerability scans, archive restores, and major retention changes during maintenance windows. These activities can consume CPU, memory, disk I/O, and browser-session availability.
If the appliance becomes slow or a job fails, check free storage, service health, System events, backup activity, scanner feed activity, and running reports before retrying.