Is it possible to set TLS to only one input?

[joshuasolman]

Is it possible to set TLS to only one input? For example:

Checkpoint --> TLS --> SC4S --> Splunk

CISCO ASA --> UDP514 --> SC4S --> Splunk

So far, i can only find information about enabling TLS for all, just wondering if i can set it per source.

Thanks!

[isoutamo]

Hi

based on this      Syslog Source Configuration    You could enable TLS globally or by some default ports like 6514 etc. Have you done the 1st one or second configuration? Usually there are many devices which cannot use TLS, so it's better to enable TLS only on some default ports and leave tcp/514 and ump/514 without it.

r. Ismo

[joshuasolman]

isoutamo, thank you for replying!

i think i was misunderstanding those options then assuming they were all grouped up. The first option would be to enable TLS globally, but you can leave that to default (no) and then enable the second option which would be to enable  TLS receiver on whatever port you choose.

Am i right in that assumption?

[isoutamo]

That is how I understand it.