Best Practices for Common Event Format (CEF) collection in Azure Sentinel

Cristhofer Munoz @Ofer_Shezaf Since the syslog server will store data locally first in plain text, there is a security risk of it being edited/accessed.

Is there a solution to this? we had a query on this requirement

In case of splunk and some other siems there is an option to send the syslog directly to splunk/others over a tcp port which then ingests, encrypts and handles the data.

https://docs.splunk.com/Documentation/Splunk/7.1.3/Data/Monitornetworkports