Currently you only need a DSB if you are planning a hierarchical/distributed ESM architecture or if you want to publish raw events to the databus to be consumed by a third-party solution. The DSB only comes in a VM and is only a single device.
Whether or not you have the DSB has minimal differences in the firewall ports. The ports that have been identified are still required to be open, but with a DSB the source and destinations may be a little different.
You can upgrade to 11.3 without a DSB and add it at a later time if desired.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.