Where should I deploy Security-Onion on the network?

[ighack]

As a novice, I use Security-Onion as a NIDS. Do I need to deploy it on the core switch to mirror all network traffic on the core switch? But it seems that only the north-south traffic is monitored, and the east-west traffic is not monitored. So I don't know exactly where to deploy it on the network. By the way. Distributed is used for production.
Our machine is on the Aliyun.

[InfosecGoon]

There are a lot of options, depending on your network architecture. Do you have a tap infrastructure (like Gigamon or Ixia), or are you using SPAN ports? Do you have multiple locations to monitor or is everything in one datacenter?

[ighack]

We have 60 server(ECS) in one VPC. They're divided into four different zone(VLAN), I can only deploy a node as a normal server in a zone, so What nodes do I need to deploy in each zone?

no SPAN port , no tap infrastructure

Forward nodes? Search nodes?
or I need deploy all type of node

[InfosecGoon]

I'm sorry, I'm having trouble following. Is this in AWS or in an on-prem datacenter?

Broadly speaking, you'll need to deploy at least three types of nodes:

Manager node - this one is installed first and handles the configuration and orchestration of the other nodes.

Search node(s) - these are installed second and record the data coming from the Forward nodes.

Forward node(s) - these are the sensors that analyze and record traffic.

[ighack]

it's in aliyun , that like AWS