Technical specifications and system requirements
Performance criteria and system limits are published per product version and kept up to date. Enterprise customers also receive an environment-specific capacity planning and sizing document.
Microservices, containers, horizontal scale
OrianaSIEM and OrianaLOG are built on a microservice architecture running on Docker. Components scale independently; a deployment that starts on a single server splits into collector, correlation and data tiers as EPS grows. The proprietary data engine, which is not based on Elasticsearch/JVM, delivers low resource consumption together with the patented Minimize algorithm.
Low-volume environments and POC
| Component | Minimum | Recommended (POC) |
|---|---|---|
| Operating system | Linux (Ubuntu Server, Debian, RHEL derivatives) | Ubuntu Server 22.04 / 24.04 LTS, minimal installation |
| Processor | 4 Core | 8 Core |
| Memory | 8 GB | 16 GB |
| Disk | At least 2 disks of equal size, LVM-capable | 100 GB OS + 2 × 250 GB data (SSD) |
| Network | 1 NIC | 2 NIC / 2 IP (to separate management and log ingestion) |
| Containers | Docker Engine 26+ and Docker Compose v2 (included in the installation package; offline image bundle if no internet access) | |
OrianaSIEM reference configurations
A single server is sufficient up to 5,000 EPS. Above that, the platform is deployed as a Kubernetes cluster; log collection/queue, database/backend and frontend/API roles are separated across at least three servers. Assumptions: average event 500 bytes, hot data 30 days, archive 365 days (730 days can be planned for Law 5651).
| Role | 5,000 EPS Single server | 15,000 EPS 3 servers · cluster | 30,000 EPS 3 servers · cluster | 50,000 EPS 5 servers · cluster |
|---|---|---|---|---|
| Server 1 · Log collection and queue | All-in-One 16 Core · 32 GB 4 TB SSD | 12 Core · 24 GB · 1 TB SSD | 24 Core · 48 GB · 1 TB SSD | 2 × (16 Core · 32 GB · 1 TB SSD) |
| Server 2 · Database and backend | 16 Core · 32 GB · 12 TB SSD | 32 Core · 64 GB · 24 TB NVMe | 2 × (32 Core · 64 GB · 24 TB NVMe) · Replica Set | |
| Server 3 · Frontend and API | 8 Core · 16 GB · 1 TB SSD | 8 Core · 16 GB · 1 TB SSD | 8 Core · 16 GB · 1 TB SSD | |
| Total | 16 Core · 32 GB | 36 Core · 72 GB | 64 Core · 128 GB | 104 Core · 208 GB |
| Peak EPS capacity | 10,000 | 30,000 | 60,000 | 100,000 |
| Daily raw log | ~200 GB | ~600 GB | ~1.2 TB | ~2 TB |
| Archive disk (HDD / Object, 365 days) | ~11 TB | ~32 TB | ~65 TB | ~108 TB |
| Network interface | 2 × 1 GbE | 2 × 10 GbE | 2 × 10 GbE | 2 × 25 GbE |
| High availability | Optional cold standby | Kubernetes cluster | Kubernetes cluster; DB replica recommended | Active-active collectors, MongoDB Replica Set |
Field reference: 3 servers for a 20,000 EPS environment (16 Core/32 GB · 24 Core/48 GB/16 TB SSD · 8 Core/16 GB). Values are reference configurations; an environment-specific sizing document is prepared separately.
Day / night load profile: High EPS during the day; archiving and compression load after 00:00 at night. Resources must be planned for EPS plus archiving load together, not for instantaneous EPS alone. For disk, SSD at minimum, with 150-200 MB/s sequential write and 1,000+ IOPS recommended.
Starting configuration for your estimated EPS
Single server up to 5,000 EPS; above that, a Kubernetes cluster of at least 3 servers. Request an environment-specific sizing document for archive disk (HDD / Object Storage) and high availability needs.
1 day once the server is ready
Platform
- Ubuntu Server 22.04 / 24.04 LTS (64-bit), minimal installation
- XFS or ext4 file system; data directory on a separate partition; LVM
- Virtualization: VMware vSphere, Proxmox, KVM or physical
- CPU/RAM reservation and thick-provisioned disk recommended
- NTP and DNS access
Network Ports
- Log ingestion: UDP/TCP 514 (Syslog), TCP 6514 (Syslog TLS), TCP 5044 (Agent)
- Management: TCP 443 (HTTPS interface), TCP 22 (SSH)
- Integration: TCP 389/636 (LDAP), UDP 1812 (RADIUS), TCP 25/587 (SMTP)
Duration and Team
- Single-server installation: 1 day
- Multi-server installation: 2-3 days (excluding source integration)
- Installation team: 1 systems engineer + 1 SIEM specialist (provided by Oriana)
- POC: 1-2 weeks, measured with real log sources
Installation Flow
- Installation script: LVM configuration → Docker installation → Product installation
- IP addresses, organization name and firewall vendor selection
- HTTPS interface; SSL certificate updates supported
- Zero-downtime version upgrades; configuration backup / restore
Agent-based and agentless collection
| Method | Protocol / Format | Typical sources |
|---|---|---|
| Syslog | RFC 3164 / 5424, UDP/TCP 514, TLS 6514; CEF, LEEF, JSON, XML | Firewalls, switches, APs, Linux, network and security devices |
| Oriana Agent (OrianaAJAN) | TCP 5044; Windows Event Log (EVTX), file monitoring | Windows servers, AD, DNS, IIS, application logs |
| NetFlow / sFlow | Flow telemetry | Routers, switches, firewalls |
| File sources | SFTP, SMB, FTP directory monitoring; text, JSON, XML, CSV | Applications, database exports, custom formats |
| Database | SQL query, ODBC / JDBC | SQL Server, Oracle, PostgreSQL, MySQL |
| API / Cloud | REST; Office 365, cloud services | Microsoft 365, cloud workloads |
| SNMP trap · PCAP | SNMP, binary | Network devices, packet capture |
| Log import | Raw log file upload | Migration of historical records, forensic investigation |
Supported systems
The platform recognizes more than 1,500 device models from over 100 vendors with built-in parsers. For sources not on the list, AI-assisted parsing and custom field extractors are used; the current list is available on the "Supported Devices" screen inside the product.
Table view
| Vendor | Models |
|---|---|
| Cisco | 176 |
| FortiGate | 112 |
| Juniper | 72 |
| Aruba | 61 |
| Ubiquiti | 57 |
| Palo Alto | 54 |
| Sophos | 53 |
| Huawei | 49 |
| WatchGuard | 48 |
| Check Point | 46 |
Firewalls and UTM (Firewall Analyzer)
Network: switches, routers, wireless, SD-WAN
Application delivery, DNS, security and monitoring
Servers, virtualization, storage and voice
Log forwarding and other SIEM / log platforms
Identity and directory
Notifications
Threat intelligence and detection content
Export and automation
On-premises, cloud, appliance, MSSP
| Model | Data location | Installation | Best suited for |
|---|---|---|---|
| On-Premise | Customer data center (physical / virtual) | Oriana team, 1-3 days | Data sovereignty, regulation, high volume |
| On-Cloud | Oriana cloud environment or the partner's own cloud | Ready environment, within days | Fast start without infrastructure investment |
| Hybrid | On-site collector + central platform | Environment-specific | Multi-site organizations |
| Appliance | On-site hardware | Plug and play | Minimum installation time, optimized performance |
| MSSP / Multi-tenant | Partner cloud or Oriana cloud | Oriana installs, partner adds customers | Multi-customer service, shared cost |
Simple and predictable
No data volume penalty
Connecting a source does not grow your license; every log reaches the platform. No cloud data egress cost.
Flexible terms
Monthly, annual or 3-year subscription; perpetual license options. EPS stays in the background for capacity planning; the quote is built on platform scope and retention period.
UEBA and intelligence included
Profiling-based UEBA, MITRE ATT&CK and IoC feeds require no additional license. Multi-tenant architecture and per-customer licensing are available for MSSP partners.
License activation is done after installation using the system ID (UID) via [email protected]. For quotes and scope, use the contact page.
Request a sizing document for your environment.
We will prepare a detailed capacity plan based on your GB/day, retention period, number of sources and HA needs.