From the OSSIM Sensors events are sent to the OSSIM Management Server and stored in the database.

OSSIM Agents feature specific plugins to gather events from external detectors such as a Checkpoint Firewall, a Real Secure IDS, a Windows machine or a Cisco Router.

Events can be filtered and consolidated in the Sensor and forwarded through a hierarchical Server structure, all controlled from a central policy manager.

It is possible to create a hierarchical topology as shown in the figure and from a central policy install specific rules to decide the forwarding, correlation, storage and consolidation behavior of each OSSIM Server.