Skip to content

Overview

Before starting the installation, let's discover how XTM One is deployed, which services it relies on and what are the minimal requirements to run it in production.

XTM One supports three deployment models: Filigran SaaS, Filigran Dedicated and Self-Hosted.

Docker deployment of the full XTM suite (OpenCTI - OpenAEV - XTM One)

If you're looking for information about the deployment of the full eXtended Threat Management (XTM) suite using Docker, please refer to this repository and documentation.

Deployment models at a glance

Filigran SaaS Filigran Dedicated Self-Hosted
Infrastructure Shared, Filigran-managed Dedicated, Filigran-managed Your infrastructure
Maintenance Filigran Filigran Your team
Upgrades Automatic Coordinated Manual
Data isolation Logical Physical Physical
Network Outbound HTTPS only Outbound HTTPS only Internal or air-gapped
Best for Fast start, small teams Regulated industries Air-gapped, full control

Filigran SaaS

Filigran hosts and operates XTM One on shared infrastructure. You access the platform through a Filigran-provided URL.

What you need

  • A Filigran subscription
  • A supported web browser (Chrome, Firefox, Edge)
  • Outbound HTTPS access (port 443) to the platform URL provided during onboarding
  • Outbound HTTPS to your identity provider (if SSO is configured)
  • Outbound HTTPS to any external service your agents connect to (AI providers, messaging platforms, etc.)

Onboarding

  1. Filigran provisions your tenant and sends you a URL and initial admin credentials.
  2. Sign in, then go to Settings to configure AI providers, SSO, and integrations.

Access provisioning

Users can access the platform through:

  • Admin invitation — admins create user accounts from Settings → Users.
  • SSO auto-provisioning — when OIDC or SAML is configured, users are created automatically on first login. SAML supports automatic group mapping from IdP group claims.
  • Self-registration — if enabled by the admin, users can register with a valid email domain.

Your responsibilities

  • User accounts, SSO, and access control
  • AI provider configuration (API keys configured from the Settings UI)
  • Agent, integration, and knowledge base setup

What Filigran manages

  • Infrastructure provisioning and monitoring
  • Platform upgrades and patches
  • Database backups and disaster recovery
  • Availability and performance

Limitations

  • No access to the underlying infrastructure, database, or containers
  • No control over environment variables or performance tuning (worker count, pool sizes)
  • Upgrade timing is controlled by Filigran
  • Custom tool sandbox mode is not configurable

Filigran Dedicated

Filigran hosts XTM One on infrastructure dedicated to your organization. You do not manage the servers, but your data is physically isolated.

What you need

  • A Filigran subscription with a dedicated hosting agreement
  • Outbound HTTPS access (port 443) from your users to the dedicated instance URL
  • Outbound HTTPS to your identity provider (if SSO is configured)
  • Outbound HTTPS to any external service your agents connect to

If your organization requires network peering or VPN access instead of public internet, Filigran coordinates the setup.

Provisioning and configuration handoff

  1. Filigran provisions a dedicated instance based on your sizing requirements.
  2. Filigran provides the platform URL and initial admin credentials.
  3. You configure the platform (AI providers, SSO, integrations) from Settings — same UI as SaaS.
  4. Infrastructure-level requests (custom domains, network peering, scaling) go through Filigran.

Your responsibilities

  • User accounts, SSO, and access control
  • AI provider configuration
  • Agent, integration, and knowledge base setup
  • Communicating sizing and capacity needs to Filigran

What Filigran manages

  • Dedicated infrastructure provisioning and monitoring
  • Platform upgrades (coordinated with your change management process)
  • Database backups and disaster recovery
  • Availability, performance, and scaling

Self-Hosted

You deploy and operate XTM One on your own infrastructure. The rest of this page covers the architecture and the infrastructure requirements; the Installation page covers the step-by-step procedure.

What self-hosting means

When you self-host, you take on responsibilities that Filigran handles in the SaaS and Dedicated models:

Area Managed (SaaS / Dedicated) Self-Hosted
Upgrades Automatic or coordinated You pull images and restart manually
Database backups Managed by Filigran Your responsibility
TLS certificates Included You provide certificates and a reverse proxy
Monitoring and alerting Included You set up your own (Langfuse, Prometheus, log aggregation)
Scaling Managed by Filigran You scale workers and tune connection pools
Infrastructure security Managed by Filigran You harden the host, network, and containers

Architecture

A deployment has five services:

┌────────────┐     ┌────────────┐     ┌────────────┐
│ PostgreSQL │     │   Redis    │     │   MinIO    │
│ (pgvector) │     │            │     │ (S3-compat)│
└─────┬──────┘     └─────┬──────┘     └──────┬─────┘
      │                  │                   │
      └─────────┬────────┴───────────────────┘
                │
     ┌──────────┴──────────┐
     │                     │
┌────┴─────┐        ┌──────┴─────┐
│ Platform │        │   Worker   │
│(API + UI)│        │(background)│
└──────────┘        └────────────┘
Service Role Default image
Platform API + frontend, port 4000 xtmone/platform
Worker Background job runner: document embedding (via SAQ, a Redis-backed async task queue) and the orchestration reconciler that drives assignment runs, evaluation runs, and sub-agent tasks. Cron scheduling lives in the platform process (autonomous scheduler). xtmone/worker
PostgreSQL Data + vector embeddings pgvector/pgvector:pg17
Redis Task queue, pub/sub, caching redis:8-alpine
MinIO S3-compatible file storage minio/minio:latest

MinIO can be replaced by any S3-compatible service (AWS S3, GCS, Azure Blob via S3 gateway).

Infrastructure requirements

System requirements

Per-container resource guidance for a production deployment with up to 200 active users:

Container Minimum RAM Recommended RAM CPU notes
Platform 1 GB 2 GB 1 core per uvicorn worker (WEB_WORKERS, production: 2 × CPU cores + 1)
Worker 1 GB 2 GB 1 core (runs WORKER_CONCURRENCY async jobs, default 20)
PostgreSQL 1 GB 2 GB 1–2 cores
Redis 256 MB 512 MB Negligible (single-threaded)
MinIO 256 MB 512 MB Negligible
Total (containers only) 4 GB 8 GB 4 cores minimum, 8 recommended

A 4-core host handles small teams. For 200 users with 4 web workers, a background worker, and PostgreSQL running concurrently, plan for 8 cores.

The host machine must have enough CPU, RAM, and disk to run all five containers plus the operating system. As a baseline, plan for at least the sum of the above plus headroom for the OS and peaks.

OS: Any Linux distribution that supports your chosen container runtime. The Docker images are based on python:3.14-slim (Debian).

Disk: 20 GB minimum for the OS, container images, and initial database. Plan for more based on your knowledge base size and file attachment volume — PostgreSQL data and MinIO object storage grow over time.

Container runtime

You need Docker Engine 24+ with Docker Compose v2.

The repository includes a ready-to-use docker-compose.yml.

Next step

Continue with the Installation procedure to deploy the platform.