Requirements
The server to prepare when Legit AI is installed in your network — memory, disk, ports and the GPU that makes the AI model fast — and what the machines it watches need.
Prepare this server when Legit AI installs the platform in your network, with or without internet — see On your own server. In Legit AI’s cloud there is nothing to provide.
The server
Section titled “The server”| Needed | Notes | |
|---|---|---|
| Operating system | Linux, x86_64 | Any distribution that runs Docker |
| Docker | Docker Engine with Compose v2 | The platform runs in containers. Legit AI’s engineer installs Docker if the server can reach your organisation’s package mirror; on a server that cannot, have it installed first. |
| Processor | 2 cores; 4 or more recommended | |
| Memory | At least 4 GB | 8 GB to run the smaller AI model, 16 GB to run the larger one without a GPU |
| Disk | 45 GB free | The platform, the AI models and room for data. Data grows with the events you send. |
| Access for the installation | An account with administrator rights | Remotely over SSH, or at the console on site |
The installation checks all of this before it changes anything, and stops with the reason if something is missing.
The AI model
Section titled “The AI model”The model runs on the same server, in its own service. It is chosen at installation for the server:
| The server has | Model | Answers |
|---|---|---|
| An NVIDIA GPU with 6 GB or more, and the NVIDIA Container Toolkit | 7B, on the GPU | In seconds |
| 16 GB of memory, no usable GPU | 7B, on the processor | Slower: tens of seconds to minutes |
| 8 GB of memory | 3B, on the processor | Slower, and less precise |
| Less | No model | Analyses are built from each alert’s own facts and marked FALLBACK |
Detection never depends on the model: rules, heuristics, baselines and correlation raise alerts the same way with or without it. See The AI analyst.
| Port | For | Open it to |
|---|---|---|
| 443 TCP | The console and the API, over HTTPS | Analysts, Windows agents, log shippers |
| 80 TCP | Redirects to HTTPS | Analysts |
| 514 UDP and TCP | Syslog from devices and servers | The networks your devices are in |
Any of them can be moved to another port at installation if it is taken. The API itself listens only inside the server.
The machines it watches
Section titled “The machines it watches”| Machine | Needs |
|---|---|
| Windows 10, 11 or Windows Server | An administrator to install the agent once; HTTPS to the platform |
| Linux server | An ordinary account the platform can sign in to over SSH; nothing installed |
| Firewall, switch, router | Syslog sent to the platform on port 514 |
For a remote installation
Section titled “For a remote installation”| SSH to the server | From the address Legit AI gives you, for the time of the installation |
| The account | One with administrator rights (sudo) on the server |
| Afterwards | Close the access again; Legit AI keeps none |
The platform is copied over that connection — about 10 GB with the AI model — and every file is checked against its checksum on the server before it is installed.