Small, Non-Resilient Deployments

In a small, non-resilient, single server deployment, all FortiSIEM and ClickHouse processes run on the Supervisor, which contains a single shard with no replicas. Collectors are often deployed to improve scalability and flexibility, and to support FortiSIEM agents, but are not mandatory for basic operation. The basic topology typically looks like this:

If smaller deployments require data resilience, they should deploy additional worker nodes to host replicas as described in the following Medium and Large Deployments with Replicas section.