Dear All,
One of our customers would like to receive their firewalls logs on their SIEM (Splunk).
They are currently using a shared firewall and we want to ensure they only get their own logs. We are planning to move them to a dedicated virtual firewall on VSX.
Could we send them logs directly from their virtual system in SMS (potentially using Log Exporter and filter-origin-in) or would it be better to use MDS and create a separate domain for them?
We are currently running R80.20, take 118.
Thanks for your help!
Best regards,
Harry
