FortiSIEM: Single host deployment for all components?

Hello,

You cannot add a Worker node to a single-node (All-in-One) instance. An All-in-One deployment consists only of a Supervisor and, optionally, a Collector. Adding a Worker node would change the setup and it would no longer be considered an All-in-One cluster.

For your second question: each role requires its own separate VM . one VM for the Supervisor and another VM for the Collector. However, adding a second Collector to an All-in-One is not required, since the standalone Collector can already perform both Supervisor and Collector functions.

You may still deploy a second Collector if you want to further distribute or reduce incoming traffic .

Hi Terasto,

yes, you understood correctly: in an All-in-One deployment, the single VM already includes both the Supervisor and Collector functionality. This means Windows agents can connect directly to the All-in-One and send logs without requiring an additional Collector.

However, if you want to apply a Windows template, segregate traffic, or scale the environment, then you will need a separate, dedicated Collector VM.