For Trellix Enterprise Security Manager, Syslog Forwarding sends the raw data for syslog protocols as a continuous stream of combined syslogs to the configured device.
Configuring your device to receive syslog:
Go to the Data Archival Settings tab and enter the following information in the Syslog Forwarding section:
Forwarding IP Address-- IP Address of the Comm Broker Sender to which the data stream should be forwarded.
Forwarding Port -- Port of the Comm Broker Sender to which the data stream should be forwarded.