System requirements for production use

Systems for production must meet or exceed the listed requirements:

System Area	Requirement
Operating system	Red Hat Enterprise Linux 7.6 through 7.9, CentOS 7.6 through 7.9
Processor	1 server-class CPU, 4 to 8 cores
Memory	Minimum of 16GB RAM, 32GB recommended
Storage	needs storage for multiple volumes: Splunk SOAR (On-premises) home directory also known as <$PHANTOM_HOME>: 500GiB mounted as either /opt/phantom/ or as <$PHANTOM_HOME> Phantom data: 500GB mounted as either /opt/phantom/data or <$PHANTOM_HOME>/data The PostgreSQL database will be stored underneath the Phantom Data mount at: <$PHANTOM_HOME>/data/db Embedded Splunk Enterprise: 500GiB mounted as /opt/phantom/data/splunk or <$PHANTOM_HOME>/data/splunk File share volumes: 500GiB mounted as /opt/phantom/vault or <$PHANTOM_HOME>/vault Disk space requirements vary depending on the volume of data ingested and the size of your production environment.
Network	A one-gigabit network interface
System utilities	cron On privileged deployments, the phantom user must have permission to create cron jobs. On unprivileged deployments, the user account that runs must have permission to create cron jobs. ntp

If you use the Files feature to store virtual machine snapshots or other large-format data, it is recommended you use a larger volume for storage.