Depending on your exact version of 7.6 (I want to say it was introduced in 184.108.40.206), you can enable sending audit logs to syslog directly within the appliance. This will send to local syslog, but then you can enable forwarding within the rsyslog.conf file for the appliances.
Sending audit logs to syslog
Forwarding to a remote syslog server (e.g. SIEM or any other log handler):
For syslog over UDP:
:msg, contains, "WebGateway" @x.x.x.x:514
For syslog over TCP:
:msg, contains, "WebGateway" @@x.x.x.x:514
Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center