# Commvault Threat Scan Requirements

The following Commvault Threat Scan requirements are for software-managed deployments and SaaS deployments where customer-managed storage is configured as a scan target.

Note

- Threat Scan for FreeBSD VMs and AIX VMs are not supported.

- When Threat Scan plans are configured to use Commvault-managed storage (default configuration), the threat scanning infrastructure is fully provisioned and operated by Commvault; no additional infrastructure or deployment steps are required. If you configure a plan to scan customer-managed storage (cloud or on-premises), you must deploy new access nodes or reuse existing backup access nodes with the required components, according to the software deployment requirements shown below or reuse existing backup access nodes.

- Since the Data Cube process can overload the Threat Scan server and impact Threat Analysis job performance, follow these guidelines:

  - Do not assign the Index Server role to Threat Scan nodes.

  - Ensure the Index Store package is not installed on Threat Scan nodes.

## License Requirements

- Commvault Threat Scan license

## Threat Scan Server Requirements

Note

Server requirements apply only to software-managed deployments. SaaS deployments using Commvault-managed storage do not require a Threat Scan server.

- Set up a server used for scanning data.

- For Windows VM workloads, set up a Windows Threat Scan server.

- For Linux VM workloads, set up a Linux Threat Scan server.

### Hardware Requirements

Component | System Limits
--- | ---
Source data size per node | 200 TB | 400 TB
Objects per node (estimated based on an average file size of 2 MB) | 100 million | 200 million
Average file size | 2 MB | 2 MB
CPU or vCPU | 16 cores | 32 cores
RAM | 32 GB | 64 GB

Note

- File indexing and Threat Analysis processes do not recognize when backup operations are running on proxies. Because these processes are resource-intensive, they can negatively impact backup performance and delay job completion. To avoid performance issues, do not overlap proxies used for Threat Analysis jobs with those used for backup jobs. The access nodes defined at the Threat Analysis plan level should be different from the proxies configured for backups (defined at the hypervisor or VM group level).

- To scale for larger configurations, you can add additional nodes, but you must ensure that the nodes are running the same OS.

- The maximum size of file that can be analyzed is 50 MB.

- A VM will be marked as skipped for a Threat Analysis job when its most recent available backup job is a synthetic full backup.

### Software Requirements

Linux

- Red Hat Enterprise Linux/CentOS 7.3 or a more recent version.

- Rocky Linux 8.x, Rocky Linux 9.x

- Ubuntu 22.04, Ubuntu 24.04

Windows

- Windows Server 2016 or a more recent version.

#### File System Restores

Verify that the destination operating system is supported before performing Threat Analysis during a file system restore.

Supported destination operating systems

- Windows (x64)

- Linux (x64)

Unsupported destination operating systems

- Solaris

- HP-UX

- IBM AIX

- Windows/Linux (x86)

- ARM64

- PowerPC (PPC)

## Package Requirements

Deploy the following packages on Threat Scan servers:

- Content Extractor

- MediaAgent

- Threat Analysis

- Virtual Server Agent

## Advanced Requirements

- For additional Threat Scan configuration information, see Commvault Threat Scan - Advanced Requirements.

×

Loading...