# Architecture and Data aggregation

**URL:** <https://forum.suricata.io/t/architecture-and-data-aggregation/237>\
**Category:** Help\
**Created:** [May 19, 2020, 8:41am UTC](https://forum.suricata.io/t/architecture-and-data-aggregation/237 "2020-05-19T08:41:20Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Coziac](https://avatars.discourse-cdn.com/v4/letter/c/c77e96/32.png) [@Coziac](https://forum.suricata.io/u/Coziac)\
**Post date:** [May 19, 2020, 8:41am UTC](https://forum.suricata.io/t/architecture-and-data-aggregation/237/1 "2020-05-19T08:41:20Z")

</div>

Hello Suricata community,

I want to run an IDS and I am quite new to those topics. After some research, Suricata seems to be very promising. I checked the documentation of Suricata for general understanding. Nevertheless I still have basic questions concerning this IDS and I hope that someone could help me a bit.

First of all:

1. Can Surricata run in an **n-tier approach,** where several sensors in the network send the captured traffic to some kind of **Master Server** where the data from the sensors are **aggregated and analyzed** for anomalies? Because I think that checking for anomalies is more effective when analyzing the big picture.

2. How does the **anomaly detection** work in Suricata? I found some free and publicly available datasets for IDSs. Do I train Suricata with datasets and **deep learning methods**? Or does the detection engine works without AI methods?

3. Is it possible to use Suricata also as a cumulative **log-server** that collects log messages from different entities in the network? If yes: can the detection engine work upon the log messages that are sent to Suricata from those entities or can Suricata only check for anomalies on logs from Suricata sensors?

I would be thankful if someone could share some expertise on this 🙂

Thank you!