High-Level Architecture for Centralized SIEM Deployment

Overview

The company structure is as follows:

• HQ Site → Hosts the SIEM Solution
• 3 Remote Sites

Each Remote Site contains:

• 5 Departments
• Each Department includes 25 Endpoints

So:

• 125 Endpoints per Site
• Total = 375 Endpoints

All logs generated from the remote sites are forwarded to the SIEM located at the HQ.

Architecture Components

A. Headquarters (Main Site)

At the HQ, the central SIEM infrastructure is deployed.

SIEM Core Responsible for:

• Parsing
• Correlation
• Alerting
• Dashboarding
• Analytics

Master Heavy Agent Collector (HQ)

• Receives logs from all remote sites
• Acts as the main aggregation point
• Forwards validated logs to the SIEM

B. Remote Sites (Site 1, Site 2, Site 3)

Each site follows the same internal structure.

Per Site Structure:

• 5 Departments
• Each Department contains 25 Endpoints
• Total per Site = 125 Endpoints

Endpoint Layer

• 25 Endpoints per Department
• Each Endpoint runs a Light Weight Agent

Department Layer

• Each Department contains 5 Heavy Weight Agents
• Heavy Agents aggregate logs from Light Agents

Site Layer

• Each Site has 1 Master Heavy Agent Collector
• This collector aggregates logs from all Departments

Communication Flow

1. Endpoints (Windows / Linux / Network Devices) generate logs.
2. Light Weight Agents collect endpoint logs.
3. Logs are forwarded to Department Heavy Weight Agents.
4. Department Heavy Agents forward logs to the Site Master Heavy Agent Collector.
5. Site Master Heavy Agent Collector securely forwards logs to the HQ Master Heavy Agent Collector.
6. HQ Master Heavy Agent Collector sends logs to the SIEM.
7. SIEM performs:

• Parsing
• Correlation
• Alerting
• Dashboarding
• Analytics

Final Architecture Design

4

The architecture demonstrates a hierarchical log collection model:

• Light Agents → Heavy Agents (Department Level)
• Heavy Agents → Master Heavy Agent (Site Level)
• Site Master → HQ Master Collector
• HQ Master → SIEM Core

This design ensures:

• Centralized visibility
• Scalable log aggregation
• Structured log flow
• Reduced bandwidth usage through aggregation
• Clear separation between site-level and HQ-level processing

لو حابب أظبطهولك بصيغة Case Study جاهزة للـ LinkedIn أو Portfolio بعنوان احترافي ومقدمة أقوى شوية قولّي 👌

لخص شويه

High-Level Architecture for Centralized SIEM Deployment

Overview

• HQ Site hosts the central SIEM Solution.
• 3 Remote Sites.
• Each site contains:
• 5 Departments
• 25 Endpoints per Department
• 125 Endpoints per Site
• Total = 375 Endpoints

All logs from remote sites are forwarded to the SIEM at HQ.

Architecture Design

🔹 Remote Site Structure

Each site follows a hierarchical model:

• 25 Light Weight Agents per Department (on endpoints)
• Logs forwarded to Department Heavy Weight Agents (×5)
• All departments forward logs to 1 Master Heavy Agent Collector (per site)
• Site Master sends logs to HQ

🔹 Headquarters Structure

• HQ Master Heavy Agent Collector receives logs from all sites
• Logs are forwarded to the SIEM Core

The SIEM performs:

• Parsing
• Correlation
• Alerting
• Dashboarding
• Analytics

Log Flow Summary

Endpoints → Department Heavy Agents → Site Master Collector → HQ Master Collector → SIEM

Final Architecture Diagram

4

This hierarchical design ensures centralized visibility, scalability, and efficient log aggregation across 375 endpoints.