Why OSSIM Architecture can be considered as Hierarchical?
OSSIM architecture allows multiple servers and agents to be arranged in a multi-level mesh topology. Each node in the mesh performs roles and tasks assigned through centralized policy. Events flow from agents to local servers, from secondary servers to primary servers or between n-level servers. This architecture allows creation of sophisticated analysis groups, with data storage in single or multiple databases.