Q about a scenario

[timcva]

I’ve reviewed the deployment scenario documentation and would like some advice from the community. Thinking about a service where customers would have the honeypot node deployed on their inside network and would report back to a central management node. Considering under 20 customer nodes, what type of management node deployment makes sense? Management node(s) could be in the cloud or in a datacenter. What are some gotchas for this scenario?

[InfosecGoon]

If you're not doing any network monitoring, simply honeypots, you could probably architect this with a ManagerSearch node in the cloud to control the deployment and receive the logs. Just make sure that your firewall rules are tight and you're not exposing it to the entire Internet, just to the necessary client IPs.