https://community.splunk.com/t5/Getting-Data-In/How-best-to-ingest-SECURE-TCP-Encrypted-Syslog-with-AirWatch/m-p/604024#M105064 <P>I suppose you could try to fiddle with tcp input and configuring tls settings for it - should be possible but not very convenient.</P><P>You can also do it with rsyslog. Configure imtcp - not imptcp - input and either write to files for UF to read or send directly to HEC input on Splunk.</P><P>You probably can do similar thing with sc4s but I'm not an expert here.</P> Thu, 30 Jun 2022 18:47:23 GMT PickleRick 2022-06-30T18:47:23Z https://community.splunk.com/t5/Getting-Data-In/How-best-to-ingest-SECURE-TCP-Encrypted-Syslog-with-AirWatch/m-p/603981#M105059 <P>Are there any recommendations on how best to ingest TLS encrypted syslog from AirWatch Cloud Console?&nbsp; The only settings in AirWatch are to select UDP, TCP or SECURETCP and the port.&nbsp; I opened a case with VMWare and they suggested to open a case with our SIEM provider for recommedations.&nbsp; I suspect the recommendation may be to send logs to an rsyslog and then use forwarder to send to splunk since that supports SSL to Splunk.&nbsp; Has anyone successfully done Encrypted Syslog from Airwatch?</P> Thu, 30 Jun 2022 21:18:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-best-to-ingest-SECURE-TCP-Encrypted-Syslog-with-AirWatch/m-p/603981#M105059 banjo5 2022-06-30T21:18:18Z https://community.splunk.com/t5/Getting-Data-In/How-best-to-ingest-SECURE-TCP-Encrypted-Syslog-with-AirWatch/m-p/604009#M105062 <P>I'm running into the same issue, but with Ricoh printers.&nbsp; But my direction will be what you outlined with sending to SYSLOG, writing to file and forwarder to read that file.</P><P>&nbsp;</P> Thu, 30 Jun 2022 18:04:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-best-to-ingest-SECURE-TCP-Encrypted-Syslog-with-AirWatch/m-p/604009#M105062 dokaas_2 2022-06-30T18:04:32Z https://community.splunk.com/t5/Getting-Data-In/How-best-to-ingest-SECURE-TCP-Encrypted-Syslog-with-AirWatch/m-p/604024#M105064 <P>I suppose you could try to fiddle with tcp input and configuring tls settings for it - should be possible but not very convenient.</P><P>You can also do it with rsyslog. Configure imtcp - not imptcp - input and either write to files for UF to read or send directly to HEC input on Splunk.</P><P>You probably can do similar thing with sc4s but I'm not an expert here.</P> Thu, 30 Jun 2022 18:47:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-best-to-ingest-SECURE-TCP-Encrypted-Syslog-with-AirWatch/m-p/604024#M105064 PickleRick 2022-06-30T18:47:23Z