Sending Syslog data via Google Chronicle forwarder

[rahul7514]

Hi 

If i am onboarding a log source via syslog using Chronicle forwarder , is it encrypted when in transit towards the Secops . 

Also if i want to onboard a log source which does not have internet connection ,how is this achievable ? 

[cmorris]

Yes, traffic will be encrypted - https://cloud.google.com/chronicle/docs/data-ingestion-flow

For the second question, can the log source communicate with a forwarder?

[rahul7514]

Yes  @cmorris it can communicate with a forwarder.

Sorry 2 more doubt, does forwarder need to be on same network of the log source?? 

When sending 2 or more log via ingestion API  is there a necessary for different port? 

[cmorris]

Hi @rahul7514,

The forwarder needs to receive data from the log source, but shouldn't matter beyond that. Keep in mind the forwarder will need to also be able to talk to SecOps - https://cloud.google.com/chronicle/docs/install/install-forwarder#beforeyoubegin
For #2, no.