We want to onboard Cisco firepower devices and we can't decide between estreamer and syslog input.
I would be grateful if you could help me to answer the questions below:
1) Is it possible to connect 1 heavy forwarder to more than 1 FMC?
2) Is there a difference in what kind of data we can receive ( ex. is syslog able to send ips data, and estreamer firewall data?) ?
3) Are there any issues with using one or the other method?