https://community.splunk.com/t5/Getting-Data-In/Help-needed-on-HEC-tokens/m-p/578133#M102093 <P>Each option has its pros and cons. In the end it usually comes down to what your source can do.</P><P>syslog is usually lighter and easier to configure on the source side and much easier to come by as implemented in various solutions but usually needs some overhead on the receiving side to make sense of it.</P><P>Sending events to HEC can be more reliable and you can - for example - set up mutual authentication between sender and receiver but is more complicated to implement so it's not very often used.</P> Sun, 12 Dec 2021 15:23:22 GMT PickleRick 2021-12-12T15:23:22Z https://community.splunk.com/t5/Getting-Data-In/Help-needed-on-HEC-tokens/m-p/578127#M102092 <P>Hello Team,&nbsp;</P><P>We need to integrate the puppet integration with splunk for the&nbsp;security related events are pushed to our Splunk SIEM. is this good to use HEC tokens for this ? or syslog is fine ?&nbsp;</P><P>&nbsp;</P> Sun, 12 Dec 2021 11:51:18 GMT https://community.splunk.com/t5/Getting-Data-In/Help-needed-on-HEC-tokens/m-p/578127#M102092 kiranpanchavat1 2021-12-12T11:51:18Z https://community.splunk.com/t5/Getting-Data-In/Help-needed-on-HEC-tokens/m-p/578133#M102093 <P>Each option has its pros and cons. In the end it usually comes down to what your source can do.</P><P>syslog is usually lighter and easier to configure on the source side and much easier to come by as implemented in various solutions but usually needs some overhead on the receiving side to make sense of it.</P><P>Sending events to HEC can be more reliable and you can - for example - set up mutual authentication between sender and receiver but is more complicated to implement so it's not very often used.</P> Sun, 12 Dec 2021 15:23:22 GMT https://community.splunk.com/t5/Getting-Data-In/Help-needed-on-HEC-tokens/m-p/578133#M102093 PickleRick 2021-12-12T15:23:22Z