Before you deploy any of the audit and monitoring service infrastructure, you should decide on the scope of the installation and whether you want to use a single installation for your entire Active Directory site, or separate installations for different geographical areas or functional groups.
The most common deployment is a single audit and monitoring service installation for each Active Directory forest, so that auditors can query and review information for the entire organization. However, if your Active Directory site has more than one forest, you might want to use more than one audit and monitoring service installation. If you want to use more than one audit and monitoring service installation, you should determine the subnetwork segments that will define the scope of each installation.
In Active Directory, a site represents the collection of Internet Protocol (IP) addresses that describe the physical structure of your network. If you are not familiar with how Active Directory sites are defined, you should consult Microsoft documentation for more information.