Your on-premises Secure Firewall Management Center must feed a Splunk instance where analysts run dashboards from the Cisco Security Cloud app. Compliance requires encrypted transport end to end, the management center's own correlation alerts must be searchable, and dashboards must show parsed fields as soon as data lands. Which Splunk collection design meets all three requirements?

The eStreamer design is the fit because the management center is the source, certificate-authenticated transport protects the feed, and the Splunk input parses records as they arrive. That lets analysts search management-center correlation alerts and use parsed fields in dashboards without waiting for a later extraction step. Sending TLS syslog from each Threat Defense device can be a sound way to collect device events and parse them on ingestion, but it does not meet the source requirement: device forwarding does not supply the management center’s own correlation alerts. Forwarding FMC events and alerts over TLS syslog preserves secure transport and makes the alerts searchable, but search-time field extraction occurs when a search runs, not when data is indexed; dashboards therefore do not have parsed fields immediately upon arrival. A TLS syslog relay can be a practical way to route and transform FMC events, and index-time parsing can make fields available promptly, but forwarding from the relay to Splunk in plaintext breaks the end-to-end encryption requirement even if the first hop is encrypted. Exam caveat: distinguish transport encryption across the entire path from TLS on only one segment, and distinguish index-time parsing from search-time extraction. Practical check: send a test correlation alert, verify it is searchable in Splunk, inspect its fields immediately after indexing, and confirm TLS is maintained on every hop.