Design validation or advice please?

[adamphetamine]

Hi,
I am about to roll out SO v2.4 and I've been over the docs a few times, have a test setup and I'm about to jump in.
I'd be grateful for advice if this is a workable setup please?
It's not super complex, 4 remote sites and under 150 devices total.

Cloud based VM will be a ‘Manager’ node

• receiving data from remote sites 'Forward Nodes' and from remote staff via Elastic Fleet

Each remote site will have a ‘Forward Node’

• local PCAP and data forwarding

Main install for Management and Threat Hunting will be a ’Search Node’ in my office

Seems ok now that I've written it down, I must get confused easily...

Thanks in advance for any advice you can give!

[dougburks]

Cloud based VM will be a ‘Manager’ node

Main install for Management and Threat Hunting will be a ’Search Node’ in my office

If I understand you correctly, then every search that you do will require the manager node in the cloud to query the search node in your office. Most folks keep the manager node and the search nodes in the same data center to keep searches as fast as possible.

[adamphetamine]

Thanks that makes sense, I'll adjust accordingly.
Cheers for your time!