Design Guide for Data Security for Dell
Introduction
This page covers deployment sizing and topology considerations for the Eyeglass Clustered Agent (ECA) that processes PowerScale and ECS audit data for Data Security. For guidance on where to place the ECA cluster relative to your PowerScale clusters (centralized vs. remote mini-ECA over WAN), see ECA Deployment Options — this page instead focuses on sizing the ECA cluster and its optional Threat Hunting components, and on licensing considerations that affect topology.
ECA Cluster Sizing
The ECA is deployed as a 3-node cluster by default. Larger environments scale by adding additional 3-node groups (6, 9, or more nodes) into the same vApp/cluster object, rather than resizing individual nodes:
- The base ECA OVA/template deploys 3 VMs.
- To build a 6-node cluster, the OVA is deployed a second time and the resulting VMs are moved into the same vCenter cluster object as the first deployment.
- Continue this pattern for larger node counts (9+) as event volume and the number of monitored clusters grows.
Each ECA node requires the following minimum resources (see ECA VM Installation for the full deployment procedure):
- OS disk: 32 GB (vSphere) or 38 GB (Hyper-V)
- Data disk: 120 GB
The Eyeglass appliance itself (separate from the ECA cluster) requires 4 vCPU, 24 GB RAM, and 172 GB total disk (52 GB OS + 120 GB data).
Memory requirements for the ECA scale with deployment size and add-on features: as a general guideline, budget a minimum of 16 GB RAM per node for basic deployments, up to 84 GB RAM for large-scale environments, with an additional 8 GB RAM for each concurrently logged-in administrator. Performance Auditor, when licensed, requires a minimum of 32 GB RAM. Confirm current sizing guidance against the Pre-Requisites page and your Superna sales/support contact before finalizing hardware orders.
Threat Hunting Machine Learning VM Sizing
When Threat Hunting is installed, an additional Machine Learning VM is deployed alongside the ECA cluster to run the anomaly-detection models. Recommended sizing scales with the number of ECA VMs in the deployment:
| ECA Cluster Size | ML VM vCPU | ML VM RAM | ML VM Disk |
|---|---|---|---|
| 3 or 6 ECA nodes | 8 vCPU | 48 GB | 300 GB minimum |
| 9 or more ECA nodes | 12 vCPU | 64 GB | 300 GB minimum |
See Threat Hunting Installation for deployment steps.
Licensing and Topology Considerations
- Each writable PowerScale or ECS cluster monitored by Data Security requires its own agent license, assigned through Eyeglass License Management. A cold/DR (non-writable) cluster can be monitored by the ECA without consuming an agent license.
- Eyeglass raises a system alarm if more writable clusters are detected in the audit event stream than there are agent licenses assigned — plan license counts for all writable clusters you intend to onboard, including future additions, to avoid mid-deployment alarms.
- Dedicated, isolated virtualization infrastructure for the ECA/Ransomware Defender VMs is a recommended best practice: since these VMs are part of the security control plane, placing them on the same hosts/vCenter as general-purpose workloads increases the risk that a compromise of that infrastructure also affects the security tooling itself.
- ECA cluster nodes must remain on the same Layer 2 subnet with low latency between nodes; splitting a single ECA cluster's nodes across data centers is not supported. This constraint is what drives the centralized vs. remote mini-ECA topology choice — see ECA Deployment Options for that decision.
See Also
- Pre-Requisites – Platform compatibility and system requirements.
- ECA VM Installation – Step-by-step ECA deployment procedure.
- Threat Hunting Installation – Machine Learning VM deployment steps.