Windows Agent connectivity through Collector only

[bhinangt]

In Service provider mode when we use Supervisor, Worker and Collector it is expected that windows agent communicate everything through collector.

However FortiSEIM windows agent guide expects that agent will send logs to collector however status update communication would be done with supervisor.

Is there any way to completely avoid role of supervisor in communication?

It is not possible to allow supervisor access to all windows end points, because if we have collector in place which is acting as proxy why do windows agent need to communicate to supervisor?

[FSM_FTNT · Accepted solution]

Hi,

If you are using the Collector to proxy the comms, then the Agent does not need to contact the Super directly. However, there is no way to completely avoid the supervisor's role, as this is where the Agent obtains policy and configuration information, such as which Collectors to upload events to.

https://docs.fortinet.com/document/fortisiem/7.1.5/windows-agent-7-1-x-installation-guide/547950/for...