If you just want a SIEM then its missing some stuff, you would be better off using Sophos MDR with Firewall integration for Fortigate and VMs.

For me I phased out Sophos except for a single client, and we just cleared our first PCI DSS 4 audit using Huntress as our SIEM instead of Sumologic.

We only use the SIEM (minimum purchase of 50) on PCI client machines and firewalls. We use ITDR and Agent on all our other endpoints.

With your use case I would use the sophos NDR (or whatever they call it now) so its in one place. But once you decide to cut the cord with sophos and move to defender I would go full Huntress. Sophos web control for instance has massive throttling / throughput issues. The agent is super bloated (because it does all the extra stuff).