FortiSIEM Collector for Windows Agent

Question

Hi,

I have a couple of related questions about FortiSIEM Windows Agent architecture:

Is it possible to install the FortiSIEM Windows Agent and configure it to send event data directly to the Supervisor, without going through a Collector?
Does an All-in-One Supervisor deployment have built-in Collector capabilities? In other words, can the Supervisor itself receive uploads from Windows Agents, or is a dedicated Collector node always required for Agent-based log collection?
If a separate Collector is mandatory, is there any workaround for small/single-node deployments, or is a Collector required regardless of environment size?

AEK · Answer

Hi VishalEven the latest version (7.5.1) still need Windows agent to send to collector.Agents must upload event data to a Collector. Therefore, minimum architecture is one Super appliance and one Collector appliance.https://docs.fortinet.com/document/fortisiem/7.5.1/windows-agent-7-5-x-installation-guide/547950/fortisiem-windows-agentHonestly I didn’t test if an agent can send directly to the Supervisor, because in case we do it and we have an issue then Fortinet may tell us this is officially not supported.Supervisor can definitely collect directly from devices, but for agent you need collector.

Sign up

Login with SSO

Login to the community

Login with SSO