Hello, I need your guidance on the following scenario: We have a SIEM (QRadar) infrastructure where Event Collectors receive logs from various data sources. These logs are correlated based on SIEM rules and use cases. we plan to send logs to the SIEM while also storing a copy in a Data Lake. Current Approach: We have structured the workflow as follows: DATA SOURCES → NiFi → Store in DATA LAKE & Forward to SIEM (using PUTTCP processor) Questions: Does NiFi allow segregation of data sources? Handling LEEF logs: logs reach NiFi with the original source IP but leave NiFi with NiFi’s source IP. Since QRadar first looks for the hostname in the payload (and if absent, uses the source IP), this could cause misidentification. Can NiFi be configured to retain the original source IP while forwarding logs, without modifying the original log (to comply with legal requirements)? Log Integrity & Authenticity: Does NiFi ensure log integrity and authenticity for legal and compliance purposes? LEEF Parsing: Is there a NiFi processor available to parse LEEF logs before storing them in HDFS? thanks in advance   ... View more