The objective of this performance test is to measure the time taken to create alerts in CyOPs™, and complete the execution of corresponding playbooks on the created alerts on a single-node CyOPs™ appliance and a cluster setup of CyOPs™.
The data from this benchmark test can help you in determining your scaling requirements for CyOPs™ instance to handle the expected workload in your environment.
Environmnent.
Component | Specifications |
CPU | 8 CPUs |
Memory | 16 GB |
Storage | 250 GB virtual disk running on top of Samsung SSD 360 Pro model attached to VMware ESX server |
Operating System | Kernel Version |
CentOS 7 | 3.10.0-957.5.1.eI7.x86_6 |
At the start of each test run -
The test was executed using an automated testbed that initiated HTTPS calls per clock tick (X alert API calls triggered at once) which created alerts in CyOPs™ and then triggered a playbook for each alert created. Steps are as follows:
The test is invoked in two different setups:
The data in the following tables outlines the number of alerts ingested in a clock tick, the total time taken to ingest those alerts, and the total time taken for all the playbooks triggered to finish execution.
Number of alerts created in CyOPs™ | Total time taken to create all alerts in CyOPs™ (in seconds) | Total time taken to execute all Playbooks (in seconds) |
25 | 2 | 10.603 |
50 | 4 | 22.578 |
100 | 9 | 45.108 |
Number of alerts created in CyOPs™ | Total time taken to create all alerts in CyOPs™ (in seconds) | Total time taken to execute all Playbooks (in seconds) |
25 | 3 | 4.670 |
50 | 3 | 5.704 |
100 | 7 | 14.616 |
In the sustenance test conducted on a two-node Active-Active CyOPs™ cluster, we could ingest 200 Alerts every 20 secs over 12 hours and observed that 202788 alerts were generated and corresponding playbooks successfully completed.
In the sustenance test conducted on a single node machine we could ingest 100 Alerts every 20 secs over 12 hours and observed that 117592 alerts were generated and corresponding playbooks successfully completed.
* The number of alerts ingested in the system are the same as the alerts generated by the performance tool.
Based on this test, we conclude that CyOPs™ could process an average of 9799 alerts in an hour in a single node and 16788 alerts in an hour in a two-node Active-Active CyOPs™ cluster. This includes creation of alerts, and running corresponding playbooks to process the alerts.
In a production environment the following factors might vary, which could affect the observations:
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.