Log Hybrid vs individual Log Decoder and Log Concentrator Applicances

[Anonymous]

What is the general rule of thumb for decided if to use a log hybrid vs separate concentrator and decoder appliances.

I currently have an Endpoint log hybrid for all endpoint logs, but it's also being used for firewall, active directory, azure etc. I'm looking to separate out the Endpoint logs from non endpoint logs and wanted to know what's the rule of thumb.

don't tell me it's 'professional services'

[Anonymous]

i don't think that there's a rule of thumb.

If you have a larger install base of endpoints > 10k or so, i would send the other Event sources to a different decoder.

It depends on the volume of the other traffic and if you are consume windows logs from your endpoints.

[Anonymous]

We certainly are sending windows logs from endpoints to the endpoint log hybrid along with sysmon events.

My question was also referring to the use of separate decoder and concentrator appliances compared to log hybrids, I see a big 'single point of failure' having everything going to a single virtual machine.