Hi,
I noticed that some audit logs are sent to the siem while others aren't when using dedicated log servers, for example - if the operation is "Incident Viewed", "Set Object", "Delete Object", so basically the least important audit logs, then the Origin Log servers is the dedicated Log Server and the logs are sent to the SIEM.
But if the Operation is "Publish", "Delete Rule", "Create Rule" or "IPS Update" Than the Origin Log Server is usually the SMS itself and these audit logs are not being sent to the SIEM (as only the dedicated servers are sending the logs).
I would like to send with log exporter all the audit logs to the siem even when using dedicated log servers, including those where the Origin log server IP is the SMS itself, as they contain info about important changes being made to IPS and access control configuration. How can that be done?
