Hi,

I think in any scenario for implementing SSIM, first it depends on geographical locations & then most imp. on your Event data size (EPS).

For your two of the remote gegraphical locations you can implement the only collector role appliances.

& at your HO, you can implement either one SSIM appliance with collection as well as correlation.

But it depends on your usage. if you are going to integrate high no of devices with your HO appliance, then you may have seperate collector role appliance & sepeate correlation+ Archive.

Following are the way in which you can configure your SSIM Appliances.

All-in-one
The SSIM system is configured to collect, archive and correlate data
This model is usually fine for  customers who’s EPS (Events Per Second) meets the rate of a single appliance

Collection only
The SSIM system is configured as a collection only device
In this option the device is only collecting events from third party devices and sending them on to be archived or archived and correlated
Customers who have large environments that are high band width will typically use collection devices

Archiving only
The SSIM system is configured as a archiving device to archive the events being sent to it from the collection device

Collection/Archiving
The SSIM system is configured to collect and archive data
This is usually done is environments that have high bandwidth or a distributed environment where you are separating out the roles of the devices.
This is also done where you want to have a dedicated device to correlating the events to handle high event loads.

Correlation only
The SSIM system is configured as a correlation device
In this option the device is only correlating events it is not configured to collect the events are store the events.
This option requires that another device is collecting and archiving the data

Correlation / Archiving
The SSIM system is configured as a archiving and correlation device.
There is usually another system that is collecting the events and feeding to this box for correlation and storage

I tried to explain this as per my knowledge, but someone from Syamntec will tell you more in detail.

Hope this helps you!!