A brain (Policy Server) with two handyman (Network Sensor and Agent) can fortify your entire network without disrupting existing network configurations.
All components can go into a single box except Agent. (Agent can be used in case you want to manipulate endpoint device configuration, enforce policies, and use them as Wireless Sensor)
Network Sensor can be separated from Policy Server to manage remote sites and get extended Wireless visibility. Agents can be used as Wireless Sensor as well.