How best to ingest SECURE TCP (Encrypted Syslog) with AirWatch?

[banjo5]

Are there any recommendations on how best to ingest TLS encrypted syslog from AirWatch Cloud Console?  The only settings in AirWatch are to select UDP, TCP or SECURETCP and the port.  I opened a case with VMWare and they suggested to open a case with our SIEM provider for recommedations.  I suspect the recommendation may be to send logs to an rsyslog and then use forwarder to send to splunk since that supports SSL to Splunk.  Has anyone successfully done Encrypted Syslog from Airwatch?

[PickleRick]

I suppose you could try to fiddle with tcp input and configuring tls settings for it - should be possible but not very convenient.

You can also do it with rsyslog. Configure imtcp - not imptcp - input and either write to files for UF to read or send directly to HEC input on Splunk.

You probably can do similar thing with sc4s but I'm not an expert here.

[dokaas_2]

I'm running into the same issue, but with Ricoh printers.  But my direction will be what you outlined with sending to SYSLOG, writing to file and forwarder to read that file.