Security onion Forward node in the cloud

[DrStupendous]

Hi guys,

I have a security onion deployment that I am deploying for a customer.
A Distributed deployment with a Manager node a Search node and a Forward node on-prem

However the client will be moving to the cloud in about a year or 2.

Would it be possible to add a forward node in their cloud environment to push logs down to the on-prem manager.

Or if anyone has a better approach that would be appreciated aswell :)

[InfosecGoon]

Yes, you can. So long as there is a VPN or another dedicated connection between their cloud environment and the on-prem datacenter, you can add a Forward node in the cloud and join it to the on-prem Manager just like you would with any other Forward Node.