6.5 Two-Tier and Three-Tier Distributed Deployment

This deployment enables you to surpass the load handling capabilities of a single central Sentinel server and share the processing load across multiple Sentinel instance by leveraging Sentinel Link and Sentinel Distributed Search features. The data collection is load-balanced across several Sentinel servers, each having several Collector Managers, as shown in the Data Collection Tier. If you want to perform event correlation or security intelligence, you can optionally forward data up to the Analytics Tier using Sentinel Link. The Search Tier provides a convenient single access point for searching across all systems in all other tiers by using Sentinel Distributed Search. Since the search request is federated across several instances of Sentinel, this deployment also has search load-balancing properties useful in scaling to handle a heavy search load.

Network flow data is stored in the Search Tier to enable easy navigation from search results to contextual network traffic analysis.

Figure 6-4 Two-Tier and Three-Tier Distributed Deployment