Firepower IPS logging - syslog vs estreamer

[sindandoh]

Hello,

Is it be possible to collect Firepower IPS connection events via syslog rather than estreamer (FMC)? If yes, is there any info that may be missed (e.g. security intelligence events, any potential interesting fields within the connection event?)

My understanding is that the FMC/estreamer adds some correlation/enrichments to the connection events. 

Thanks,

[Marius Gunnerud]

As far as I know you need to use estreamer to get IPS, security intelligence, (etc.) type events.