Trying to forward the logs that arrive into the indexer/head into another 3rd party Siem tool. Rather than setting the universal forwarders to do this (two destinations) I was thinking that since they have already arrived to single location I can get a copy and send them to another tool.
Is that even possible? if so what are the cons with this?
Any insight would be greatly appreciated.
... View more