This is the current version - but will change a bit with Hybrid Hunter - https://securityonion.readthedocs.io/en/latest/architecture.html#distributed