Introduction

This article is intended to help you understand the License Management Portal's sensor selection form and how to select the appropriate sensor for your client.

To learn more the differences between virtual or physical sensors, as well as the difference between an MDR SIEM sensor (formerly termed the primary appliance) and secondary sensors, see our Help Center chapter on the subject.

Example Scenarios

The following section outlines 7 unique customer profile scenarios you may encounter and how to appropriately select sensor for the client. 

Scenario 1: business with no network monitoring requirements

Client Situation: 

This client organization has a single office location that does not require network monitoring, as a small cloud-based business. They have a user count of less that 100 users total.

Sensor Selection:

The MDR SIEM sensor for this client profile would be virtual, and since no network monitoring is required, no hardware would be shipped to this client.

Scenario 2: business with network monitoring requirements   

Client Situation:

This client organization has a single office location that requires network monitoring, and their infrastructure supports port mirroring. They have a total user count of less than 200 users.

Sensor Selection:

The MDR SIEM sensor for this client profile would be a virtual sensor, and since they have infrastructure that supports port mirroring, a Compact One should be shipped to their location for network monitoring. 

Scenario 3: business with multiple locations and <200 users

Client Situation:

This client organization has two locations that require network monitoring, and both locations support port mirroring. Each network has a total user count of less than 200.  

Sensor Selection:

The MDR SIEM sensor for this client profile would be a virtual sensor, and a Compact One should be shipped to each network location, since both sites support port mirroring.

Scenario 4: business with multiple locations and varied user counts   

Client Situation:

This client organization has two locations that require network monitoring, and both locations support port mirroring.  One network has a total user count of over 200 and the other network has a total user count of less that 200.  

Sensor Selection:

The MDR SEIM sensor for this client profile would be a Business One, and it should be shipped to the location with a user count of over 200 on their network. (NOTE: that If this user count would exceed 500, a larger sensor may be required. This would require a discussion with your Account Executive because you will be unable to request the correct sensors from the License Management Portal)

A Compact One should be shipped to the location with a network count of less than 200 total users.

Scenario 5: business with multiple locations and varied port mirroring support

Client Situation:

This client organization has two locations that require network monitoring, but only one of the locations support port mirroring. Both networks have a total user count of more than 200.

Sensor Selection:

The MDR SIEM sensor for this client profile would be a Business One, and it should be shipped to the location that does not support port mirroring. A Business One should also be shipped to the second location because its user count is greater than 200 users.

Scenario 6: business with 4 locations 

Client Situation:

This client organization has four locations that require network monitoring, and all locations support port mirroring.  All networks have a total user count of less than 200. 

Sensor Selection:

Since the virtual sensor only supports up to two locations, the MDR SIEM sensor for this client profile would be a Business One, shipped to their headquarters/primary location. 

A Compact One should be shipped to all other locations.

Scenario 7: large business with multiple locations and >200 user counts

Client Situation:

This client organization has more 5 locations that all require network monitoring, and they all support port mirroring. Two sites have a user count of less that 200, but three of these sites have user counts of more than 200. 

Sensor Selection:

Since the virtual sensor only supports up to two locations, the MDR SIEM sensor for this client profile would be an Enterprise One, shipped to their headquarters/primary location.

The three secondary sites with a user count of over 200 would qualify for a Business One. NOTE: Any networks with more than 500 users would require a discussion with your Account Executive because you will be unable to request the correct sensors from the License Management Portal.

All secondary sites (that require network monitoring) with a user count of less than 200 would be shipped a Compact One.

Example Scenarios: Quick Reference Guide 

The following table acts as a quick reference guide for the seven deployment scenarios describes above.