Can the SEDR Virtual Machine use a network storage for the virtual hard drive?


Article ID: 171355


Updated On:


Endpoint Detection and Response Advanced Threat Protection Platform


You are deploying the ATP or SEDR as a virtual appliance and want to know if you can use your existing NAS/SAN/LUN as the storage location for the virtual hard drive that is built in to the OVA.


The SEDR software has not been tested nor certified for using non-local disks for the .vmdk file. The appliance software is running several instances of relational databases. The most resource intensive database is Elasticsearch, which have made statements that this is not suggested. If there is a requirements for the use of a NAS/SAN/LUN, you may attempt to deploy the ATP in this fashion, but it is not likely to work.

"...avoid network-attached storage (NAS). People routinely claim their NAS solution is faster and more reliable than local drives. Despite these claims, we have never seen NAS live up to its hype. NAS is often slower, displays larger latencies with a wider deviation in average latency, and is a single point of failure."