A security engineer needs Secure Firewall Management Center alerts and connection events to reach Splunk near real time, with decoded source, destination, application and user fields preserved for AI-driven correlation. Which Management Center output method best meets these needs?
Select an answer to reveal the explanation.
Short Explanation
Set up eStreamer on your Management Center and connect it to a Splunk eStreamer client to stream both alerts and connection events with decoded fields, like handing Splunk a fully labeled package. Syslog feeds here cover only one event type, and a fifteen-minute poll is too slow for near-real-time correlation.
Full Explanation
eStreamer is the best fit because it streams Management Center event data to a compatible client, allowing Splunk to ingest alerts and connection events with their decoded context for near-real-time correlation. That context matters for AI-driven use: source and destination, application, and user should remain available as usable event fields rather than being reduced to a notification or needing reconstruction. Syslog is a common way to forward intrusion-alert notifications quickly, and parsing can expose fields in those messages, but an alerts-only feed leaves out the required connection events. A REST API add-on can retrieve both event types and preserve decoded fields, yet polling every fifteen minutes introduces a delay inconsistent with near-real-time delivery. Syslog connection-event forwarding can provide timely, decoded connection records, but the connection-events-only feed omits alerts. Exam caveat: syslog and API capabilities vary by Management Center version, configuration, and integration; judge the stated feed scope and cadence, not the protocol name alone. Practical check: in a test deployment, verify that both event types arrive within the required latency and that source, destination, application, and user are populated as distinct fields in Splunk.