Defender for Identity の TLS Syslog での SIEM (IBM QRadar) への連携（English follows）

お世話になっております。

Defender for Identity のログを TLS Syslog で SIEM (IBM QRadar on Cloud) へ連携を試みています。

QRoC側：https://www.ibm.com/docs/en/qradar-on-cloud?topic=overview-sending-tls-syslog-data-qradar-console

Defender for Identity側：https://learn.microsoft.com/en-us/defender-for-identity/notifications#syslog-notifications

Syslog ペイロード先頭に付与される、ホスト名/IPに該当するカラムにはセンサー名が入る認識ですが正しいでしょうか。

We're trying to send Microsoft Defender logs to QRadar on Cloud (SaaS) with TLS Syslog protocol.

QRadar on Cloud: https: //http://www.ibm.com/docs/en/qradar-on-cloud?topic=overview-sending-tls-syslog-data-qradar-console

Defender for Identity: https://learn.microsoft.com/en-us/defender-for-identity/notifications#syslog-notifications

We have to identify the strings which are in the column in the head of the payload, in which usually IP/hostname is filled.
I suppose “Sensor Name“ listed in the MS Defender for Identity dashboard will be the one. Is that correct?