Prerequisites and Considerations for Adding Capabilities

Be sure to review the capability-specific prerequisites listed here Configuring Elasticsearch Settings.

Before deploying additional capabilities to an existing cluster, review and, if necessary, perform the following tasks.

Ensure that your existing cluster has the supported version of the Platform required to deploy the additional capabilities. If your deployment does not have the supported version, you must upgrade the Platform using the instructions in Upgrading Your Environment. For information about the supported version of the ArcSight Platform, see the Technical Requirements for ArcSight Platform 23.3.
Recon and Intelligence both require the ArcSight Database. If you are adding these capabilities and your deployment does not already have the database, you will need to install the database using the instructions in this section.
Check the system size of your existing ArcSight Platform Kubernetes cluster and, if applicable, ArcSight Database and ensure that it can handle the additional workload of the capabilities you want to add. If your existing cluster cannot handle the additional workload, scale the Kubernetes cluster or database as needed before deploying the additional capabilities. For information about host sizing for the Platform, see the Technical Requirements for ArcSight Platform 23.3.
For Intelligence, configure SmartConnectors for data collection. For more information about data collection, see the SmartConnector Installation and User Guide and SmartConnector Configuration Guides in ArcSight SmartConnectors documentation.