FortiSIEM Discussions
bhinangt
New Contributor II

Windows Agent connectivity through Collector only

In Service provider mode when we use Supervisor, Worker and Collector it is expected that windows agent communicate everything through collector.

However FortiSEIM windows agent guide expects that agent will send logs to collector however status update communication would be done with supervisor.

 

Is there any way to completely avoid role of supervisor in communication?

It is not possible to allow supervisor access to all windows end points, because if we have collector in place which is acting as proxy why do windows agent need to communicate to supervisor?

1 Solution
FSM_FTNT
Staff
Staff

Hi,

 

If you are using the Collector to proxy the comms, then the Agent does not need to contact the Super directly. However, there is no way to completely avoid the supervisor's role, as this is where the Agent obtains policy and configuration information, such as which Collectors to upload events to.

 

https://docs.fortinet.com/document/fortisiem/7.1.5/windows-agent-7-1-x-installation-guide/547950/for...

View solution in original post

1 REPLY 1
FSM_FTNT
Staff
Staff

Hi,

 

If you are using the Collector to proxy the comms, then the Agent does not need to contact the Super directly. However, there is no way to completely avoid the supervisor's role, as this is where the Agent obtains policy and configuration information, such as which Collectors to upload events to.

 

https://docs.fortinet.com/document/fortisiem/7.1.5/windows-agent-7-1-x-installation-guide/547950/for...