Depending on your exact version of 7.6 (I want to say it was introduced in 188.8.131.52), you can enable sending audit logs to syslog directly within the appliance. This will send to local syslog, but then you can enable forwarding within the rsyslog.conf file for the appliances.
Sending audit logs to syslog
Forwarding to a remote syslog server (e.g. SIEM or any other log handler):
For syslog over UDP:
:msg, contains, "WebGateway" @x.x.x.x:514
For syslog over TCP:
:msg, contains, "WebGateway" @@x.x.x.x:514