FortiSiem 6.3 all in one

[saidbelhaj]

Hello,

For Fortisiem 6.3, can I install Supervisor and collector on the same VM (with the same IP) or should install separately ?

[ede_pfau]

Yes, you can. It's not so uncommon at all. We're using a single worker instance for around 1000 devices, from FGTs to switches, NetApp, ESXi's etc., on a 1 Gbps connection on the LAN. Load is not a problem.

You'd utilize the leverage of external collectors if either the number of devices is high, or their log volume is, or you are getting medium to high data rates from distant locations, which includes high latency/low throughput WAN lines. In short, for scalability and/or decentral data acquisition.

[saidbelhaj]

As I can understand, for new install for 50 devices, I installed the supervisor, I will use agents so should I add the collector in this case or only the supervisor ?