5.6.x Security Fabric and Branch Locations over IPsec VPN - Same/Different Fabric?

[tanr]

Our upgrade to 5.6.5 is almost done so looking at Security Fabric details for branch locations.

Are people with small networks and always connected branch locations (like us) having the branch locations be part of the same security fabric (same Group name, connecting to root upstream FortiGate at your main office over VPN), or are you creating a separate security fabric for your branch locations and just connecting to your main office FortiAnalyzer over VPN?

Thanks.