A common question, especially for new customers who are deciding where to place network sensors is, "What is the difference between a Cloud Collector and a Comm Broker?" Since you can install either type of appliance from the same ISO image, it is important to understand why you might use one type versus the other.
|
As you can see in the figure above, the Comm Broker component exists in both the Comm Broker and the Cloud Collector. The Comm Broker component collects logs from network sources through the management interface. If you are only interested in collecting log data from a particular segment of your network, you can install a Comm Broker.
By contrast, if you want your network sensor to run some analysis on the data before sending it to Helix, install the Cloud Collector. In addition to the log collection performed by the on-board Comm Broker, the Cloud Collector has a network security monitor that provides protocol analysis and packet capture.