How to choose: answering the main questions
What does a SIEM system require?
Write and search speed: NVMe for hot indexes (7–30 days), high-capacity HDDs for event archives, and 64+ GB of RAM. Calculate based on EPS (events per second): 5000 EPS already requires 12+ cores and fast disks.
Should security tools be virtualized?
Firewalls and DLP are latency-sensitive — they require dedicated resources or separate hardware with SR-IOV. SIEM and log collectors run perfectly in virtual machines.
Requirements of RK regulators?
For critical information infrastructure (CII) and government agencies, requirements for certified information security tools and data localization apply. We assemble platforms for certified software with full documentation for audits.