WitFoo Precinct can be deployed as an All-in-One Appliance for organizations with less than 1 million events per hour or can be deployed in a horizontally & vertically scaling architecture to allow for millions of events per second and long term retention and processing.
Deployment Video Guide
Deployment Options
WitFoo Precinct can be deployed in several methods.
Hypervisors: Use the OVA/VHD downloads under Downloads on this page.
A 30 day trial license is automatically issued on all new appliance deployments when they launch. To obtain a trial license manually, please fill out this form. To obtain a production license, please request a quote and a WitFoo Partner will deliver the quote. Cloud hosted licensing on pay-as-you-go appliances are automatically billed to the cloud account. Pricing details are available on the pricing page for software only and the cloud page for SaaS offering.
Appliance Nodes
WitFoo Precinct is deployed via appliance nodes. There is an All-in-One appliance that contains all three WitFoo Precinct components. Each node can handle up to 1 million records per hour when clustered (at optimal resource allocation and Core processing level.) Appliance CPU and RAM must comply with the chart below and must be adjusted on OVA import.
All-in-One – Contains Investigative Engine (IE), Streamer and Data nodes. Rated up to 1M eph.
Investigative Engine (IE) Node – Provides the user interface and centralized configuration as well as distributed processing and analysis.
Streamer Node – Receives, parses, and stores Syslog and NetFlow in a WitFoo Artifact in Data Nodes. Also includes the Investigative Engine.
SaaS Streamer requires more resources for CPU and RAM due to added Dispatcher functionality.
Data Node – Cassandra data cluster node to receive, store and process WitFoo Artifacts and Relational (SQL) data cluster.
Best Practice Note: Initial deployments that are created in a minimum horizontal cluster allow for simple expansion without the need to migrate data. For most enterprises, the configuration below allows for horizontal scale flexibility:
One (1) IE Node
One (1) Streamer Nodes for each transport type (syslog, NetFlow, Beats, Cloudwatch, Splunk)
Three (3) Data Nodes
For additional performance and scale guidance please refer to this training module: https://vimeo.com/277872139.
The operating system of WitFoo Precinct is Ubuntu 20.04 LTS. Before running ./register ensure networking is configured correctly. For reference see: https://ubuntu.com/server/docs/network-configurationIt is highly recommendedthat network configuration be handled through DHCP scope reservations.
