# To the SIEM over TLS: everything at notice or above, plus pf, logins and doas at info
*.notice;local0.info;auth.info;authpriv.info		@tls://siem.internal:6514