It is possible to use the same Siemplify agent (SOAR) to send Forwarders logs (SIEM) ?

[YanGuilherme]

I need to use a syslog server to send firewall to SecOps via the Fowarders agent, but i also want to use in this server the Connectors logs of the firewall.
It is possible to use the same Siemplify agent (SOAR) to send Forwarders logs (SIEM) or the only way to this work in the Syslog server is to use two agents?

[mikewilusz · Accepted solution]

The SOAR remote agent acts as a proxy to allow the SOAR to use non-Internet resources for things like enrichment and actions. It does not do log collection for the SIEM.

The Chronicle Forwarder, or now also Bindplane/Chronicle Collection Agent, do actual syslog collection and relay to the SIEM. These can run the same server as the remote agent, but they are distinct functionality.

-mike