Defensse installs on one Linux server you control — your data never leaves it. Below is the honest hardware bill: what the platform actually consumes, what each plan needs, and how the box grows with the number of endpoints you monitor.
Defensse is a Docker Compose stack. Which containers start depends on your plan — and the memory each group holds is the reason the numbers below look the way they do.
These are measured figures, not estimates — taken from a live Defensse installation running the full stack. The complete platform idles at roughly 9.5 GB. Your sizing target is that number plus room for the alert volume your endpoints produce.
Starter runs the GRC platform alone and is comfortable on a small VPS. The moment the SOC comes on, the search engines set the floor.
One agent runs on each Linux server you want watched. Agents are cheap on the endpoint and expensive on the collector — every one of them adds events to index and keep. Pick the row that matches your fleet.
| Linux endpoints | vCPU | Memory | Disk (365-day retention) | Indexer heap | Topology |
|---|---|---|---|---|---|
| Up to 10 | 8 cores | 16 GB | 250 GB NVMe | 1 GB | Single server. The default install, unchanged. |
| Up to 30 | 8 cores | 24 GB | 500 GB NVMe | 2 GB | Single server. Raise the indexer heap at install time. |
| Up to 50 | 12 cores | 32 GB | 1 TB NVMe | 4 GB | Single server. Put the indexer data on its own volume. |
| Up to 100 | 16 cores | 48 GB | 2 TB NVMe | 8 GB | Single server, but a dedicated data disk is now required, not advisory. |
| 100 – 250 | 24 cores | 64 GB | 4 TB NVMe | 16 GB | Two servers: the Wazuh indexer moves to its own node, the platform keeps the first. |
| 250 + | — | — | — | — | Multi-node indexer cluster and a second Wazuh manager. We size this with you — get in touch. |
Disk is the only line that keeps growing after install, so it is worth understanding rather than trusting. Here is the arithmetic behind the table.
Anything that runs a current Docker Engine will work. These are the distributions the installer is tested against.
Other modern distributions with Docker Engine 24+ are expected to work, they are simply not part of the release test matrix.
git, curl, opensslsudovm.max_map_count=262144 — set for you at install; both search engines refuse to start below itNothing beyond the web ports has to face the public internet — the agent ports only need to be reachable from the endpoints you monitor.
Fully air-gapped installs are possible with a local registry and mirrored feeds — that is an Enterprise deployment, arranged with us.
Almost nothing. The agent collects and ships — the analysis all happens on the Defensse server, which is why that server is the one you size carefully.
apt and yum/dnf both handledThe Defensse server itself is Linux-only. There is no Windows Server build and one is not planned — the platform ships as a Linux container stack, and the search engines it depends on are only supported that way. Running it under WSL or a Windows Docker Desktop host is not supported either.
The machines you monitor are a separate question. Agents install on Linux and Windows endpoints alike, and both report into the same console. The sizing table above counts Linux endpoints; a Windows endpoint typically produces two to three times the event volume, so count each one as roughly three when you read the table.
Send us how many servers you need watched and which framework you report against. You will get a concrete spec, and a price, within one business day.