Thank you for the clarification. Also, may I know what the use of universal forwarder credentials is when the date comes via HEC?
Technically, data from UF does _not_ come via HEC to Cloud but is sent with S2S protocol embedded in HTTP requests. But it does connect with HTTP protocol and needs an authentication token. Otherwise everyone could send data to your environment.
HEC inputs on Cloud are TLS-enabled by default.
