Sizing recommendations for the virtual

appliance
Last Updated November 5, 2022
Symantec EDR
 has increased the default configuration for the virtual image. The virtual appliance
OVA is built with 48 GB of RAM and hard disk of 500 GB with 12 CPU cores. The
primary reason for the increase is to support the endpoint activity recorder
functionality. But we also recommend the increase because of the challenges in
supporting deployments with only 4 cores. As a general recommendation, we
suggest that you increase the VM resource. And resources should not only be
allocated, but reserved. If resources are not allocated and reserved, the 
Symantec EDR
 management server responsiveness might be impacted by a heavy load on a
shared virtual environment.
When you upgrade from Advanced Threat Protection 2.x to 3.x, you should allocate
more resources to your VM image. Symantec recommends that you allocate more
resources regardless of whether you intend to use the endpoint activity recorder
functionality or not.
Changes to recommended VM resources
Advanced Threat Advanced Threat Symantec
Protection 2.x Protection 3.x  4.x
Memory 32 GB 48 GB 48 GB
Cores 4 12 12
Sizing recommendations for the virtual appliance
Total Transfer R
Role Mode Storage
Endpoints MB/sec/End
All-in-one TAP 500 GB 2000 150 KB
TAP with Endpoint 500 GB+2
Activity Recorder (EAR) TB
enabled
All-in-one Inline Monitor/block 500 GB 2000 150 KB
NOTE:  Inline mode is only Inline Monitor/block with 500 GB+2
recommended for virtual EAR TB
appliances for testing purposes
Management server only Management server 500 GB 50000 150 KB
Only 500 GB+2 10000
Management server TB
Only with EAR
Scanner only TAP 500 GB 2000 150 KB