Hi @Ramachandran  The recommended hardware specification for SOAR On-Premise is  Processor 1 server-class CPU, 4 to 8 cores Memory Minimum of 16GB RAM, 32GB recommended Storage Splunk SOAR (On-premises) needs storage for multiple volumes: Splunk SOAR (On-premises) home directory also known as <$PHANTOM_HOME>: 500GiB mounted as either /opt/phantom/ or as <$PHANTOM_HOME> Phantom data: 500GiB mounted as either /opt/phantom/data or <$PHANTOM_HOME>/data   The PostgreSQL database will be stored underneath the Phantom Data mount at: <$PHANTOM_HOME>/data/db File share volumes: 500GiB mounted as /opt/phantom/vault or <$PHANTOM_HOME>/vault Disk space requirements vary depending on the volume of data ingested and the size of your production environment. For more info check out https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/6.4.1/system-requirements/system-requirements-for-production-use Note that 4vCPU doesnt necessarily = 1 Server Class CPU with 4 Cores as per the spec. There are no specific requirements based on the number of playbooks but using the referenced hardware spec should cover full production use of SOAR and thus should handle your multiple playbook scenario. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Ramachandran  Are you running ES and SOAR On-Premise? Please could you confirm the versions you are using. You mentioned that connectivity is in place between the installations - please could you verify that the correct "Allowed IP" was used when setting up your service user (https://docs.splunk.com/Documentation/SOARonprem/latest/Admin/Users#:~:text=Create%20an%20automation%20user%20in%20Splunk%20SOAR%20(On%2Dpremises)) Failing this you might want to look at temporarily disabling SSL validation to rule out SSL issues (https://docs.splunk.com/Documentation/PhantomApp/4.0.10/Install/ConfigureCerts#:~:text=Admin%20Manual.-,Manage%20HTTPS%20certificate%20validation%20using%20the%20REST%20API,-In%20Splunk%20Enterprise) - Note: Even though you see a 500 error, this isnt necessarily a 500 code from SOAR (which would imply SSL is fine), its from the API endpoint in Splunk which reaches out to SOAR.  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more