Decrypting encrypted log traffic to the forwarder

[cmschelin]

We have a Chronicle forwarder set up, and we plan to send logs to it. Logs will be sent over the internet, so we're looking to encrypt the syslog data coming from our servers (rsyslog for Linux, nxlog for Windows).

How do we ensure that the Chronicle forwarder unencrypts those logs before sending them up to the cloud?

[DanHansen]

If I'm correct the forwarder encrypts data, sends it to Chronicle, Chronicle receives said data in encrypted form, catalogs it in encrypted form and stores it in encrypted form. In other words if the log is visible to you in Chronicle it is/was encrypted. Basing that logic on Google's Data Ingestion Overview.