A global retailer wants its security operations team to watch Secure Firewall Management Center connection events, discovery events, and intrusion alerts in an existing Splunk index, with every event encrypted in transit and delivered as a single feed that AI-driven threat intelligence can triage. Which forwarding design should the team configure on the Management Center?

The eStreamer design is the best fit because the Management Center can publish its managed event data as a continuous feed, including connection, discovery, and intrusion events, while TLS protects the connection to Splunk. It also supports the requested centralized ingestion into the existing index, giving downstream analytics a consistent source to triage. Scheduled REST polling is a legitimate integration pattern for API-accessible data, and HTTPS can protect it in transit; however, the described polling scope retrieves connection and intrusion events but omits discovery events, so it does not provide the required event coverage. CEF over encrypted syslog is a common SIEM integration and can carry the requested event classes, but splitting them into separate feeds violates the requirement for a single feed for AI-driven triage. Sending encrypted syslog directly from managed firewalls can centralize device-generated connection and intrusion records in Splunk, but it bypasses the Management Center as the forwarding source and does not supply its discovery events. Exam caveat: TLS support, event availability, and format compatibility vary by product version and configuration; do not assume that a secure transport alone guarantees complete event coverage. Practical check: validate a test feed in Splunk for all three event types, confirm it lands in the intended index, and verify TLS certificate validation and the receiving endpoint’s configuration.